On Mon, Mar 27, 2017 at 10:50 AM, Marc Baker <marcjbake...@gmail.com> wrote: > OSSEC agents this morning were working without issue and then began > reporting as Disconnected. Agent logs are returning the following error: > > 2017/03/27 10:14:38 ossec-agent: WARN: Process locked. Waiting for > permission... > > 2017/03/27 10:14:49 ossec-agent(4101): WARN: Waiting for server reply (not > started). Tried: '. > > 2017/03/27 10:14:51 ossec-agent: INFO: Trying to connect to server (:1514). > > Nothing has changed on the server to the best of our knowledge. One anomaly > we are seeing that may be related is the following when restarting Wazuh > manager services: > > > Deleting PID file '/var/ossec/var/run/ossec-remoted-4816.pid' not used...
Looks like remoted died. You might want to ask about this on the Wazuh mailing list. They should be able to help you track it down. > Killing ossec-monitord .. > Killing ossec-logcollector .. > ossec-remoted not running .. > Killing ossec-syscheckd .. > Killing ossec-analysisd .. > Killing ossec-maild .. > Killing ossec-execd .. > Killing wazuh-modulesd .. > Wazuh v2.0 Stopped > Starting Wazuh v2.0 (maintained by Wazuh Inc.)... > Started wazuh-modulesd... > Started ossec-maild... > Started ossec-execd... > Started ossec-analysisd... > Started ossec-logcollector... > Started ossec-remoted... > Started ossec-syscheckd... > Started ossec-monitord... > Completed. > > > /var/ossec/bin/ossec-analysisd -V > Wazuh v2.0 - Wazuh Inc. > > This program is free software; you can redistribute it and/or modify > it under the terms of the GNU General Public License (version 2) as > published by the Free Software Foundation. For more details, go to > http://www.ossec.net/main/license/ > > /etc/ossec-init.conf > DIRECTORY="/var/ossec" > NAME="Wazuh" > VERSION="v2.0" > DATE="Wed Mar 15 11:38:44 UTC 2017" > TYPE="server" > > Any suggestions would be greatly appreciated. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
