OSSEC/Wazuh Agent Connection Issue with Master and Worker Nodes in GCP

[Kelvinloucosta]

I'm experiencing an issue where the OSSEC/Wazuh agent initially fails to connect when pointing directly to the worker node in our Google Cloud Platform (GCP) environment. However, the agent successfully connects and becomes active when first configured to point to the master's IP and then switched to the worker's IP.

<ossec_config>

10.10.250.30
1514
tcp

<!-- Secondary server (Worker) -->
<server>
  <address>10.10.250.35</address>
  <port>1514</port>
  <protocol>tcp</protocol>
</server>

has anyone experienced this, would you have another way of configuring this, as I find it very complex to configure this manually on each agent.