Re: [ossec-list] OSSEC Agents cache Events if OSSEC Server is down nowadays?

2015-01-13 Thread SoulAuctioneer
I just investigated this as I've been working on the eventchannel code quite a bit. The eventchannel stuff will both bookmark the last location so the agent can pick up again where it left off. Also, if the manager is down and seen as disconnected by the agent than it will also behave the same

Re: [ossec-list] OSSEC Agents cache Events if OSSEC Server is down nowadays?

2014-06-18 Thread horst knete
Hi, thx for your response. Considering some changelogs that i saw and the tests that i made, ossec still dont buffer the logs/ continue with the last not sent event. Indeed i tested NXLOG as the shipper for windows-events and it works pretty well in the comunity edition but dont have the

Re: [ossec-list] OSSEC Agents cache Events if OSSEC Server is down nowadays?

2014-06-18 Thread dan (ddp)
On Wed, Jun 18, 2014 at 2:19 AM, horst knete baduncl...@hotmail.de wrote: Hi, thx for your response. Considering some changelogs that i saw and the tests that i made, ossec still dont buffer the logs/ continue with the last not sent event. The OSSEC project does accept code contributions.

[ossec-list] OSSEC Agents cache Events if OSSEC Server is down nowadays?

2014-06-17 Thread horst knete
Hey Guys, we are implementing an OSSEC Installation in our Environment due the the great functionality of the System. We got Agents on both Linux and Windows and the Log Shippment is working fine. But as we tested what happen if the OSSEC Server goes down (i. e. for maintenance) the

Re: [ossec-list] OSSEC Agents cache Events if OSSEC Server is down nowadays?

2014-06-17 Thread dan (ddp)
On Tue, Jun 17, 2014 at 4:17 AM, horst knete baduncl...@hotmail.de wrote: Hey Guys, we are implementing an OSSEC Installation in our Environment due the the great functionality of the System. We got Agents on both Linux and Windows and the Log Shippment is working fine. But as we tested

Re: [ossec-list] OSSEC Agents cache Events if OSSEC Server is down nowadays?

2014-06-17 Thread dan (ddp)
On Tue, Jun 17, 2014 at 4:17 AM, horst knete baduncl...@hotmail.de wrote: Hey Guys, we are implementing an OSSEC Installation in our Environment due the the great functionality of the System. We got Agents on both Linux and Windows and the Log Shippment is working fine. But as we tested

Re: [ossec-list] OSSEC Agents cache Events if OSSEC Server is down nowadays?

2014-06-17 Thread Michael Starks
On 2014-06-17 3:17, horst knete wrote: Hey Guys, we are implementing an OSSEC Installation in our Environment due the the great functionality of the System. We got Agents on both Linux and Windows and the Log Shippment is working fine. But as we tested what happen if the OSSEC Server goes