This message when found on an agent can mean one of two things:
1. The agent is temporarily unable to connect to the hub.
2. The agent has the wrong key, or the key has been deleted or been otherwise corrupted on the agent system.
For temporary network issues, the agent will cache up to 5000 events and will continue to attempt to connect to the hub automatically. No action is necessary with the agent, however users should investigate why their system is unable to connect to their hub.
For invalid or corrupt keys, ensure that you have the correct key installed for that specific agent. Agent keys are unique to each agent, and no two agents may have the same key. Keys are used to uniquely identify agents.
If needed you can re-key the agent displaying this error by running the below command as root on the impacted agent.
To re-key on UNIX and Linux systems run these command in this order as the root user:
/var/ossec/bin/ossec-control stop
/var/ossec/bin/agent-auth -m <HUB_ADDRESS>
/var/ossec/bin/ossec-control start