Hi Abhi,
yes, OSSEC reads the files /var/ossec/queue/agent-info/* to know if agent
is active or not. More
information: https://groups.google.com/forum/#!topic/ossec-list/ijwdhMoXD4Q
Remove all files (so, now the state of every agent is Never connected), and
restart manager and agents. After
Hi!
I am facing the same problem. Out of 40 agents , 3 agents are behaving like
this. It shows 'Never Connected' in server even though I am receiving
alerts for these 3 agents. I created file in /var/ossec/queue/agent-info.
It made them 'Active' but then agents got disconnected within an hour.
Hi,
We are using automated scripts through Chef to instal OSSEC and use
ossec-authd to control key exchange. After a recent install, the Agent is
sending the alerts correctly, but OSSEC(ossec_agent_control) still reports
that the agent has Never Connected. I have verified that it's same
On Wed, Oct 8, 2014 at 2:25 PM, Abhi abhijittike...@gmail.com wrote:
Hi,
We are using automated scripts through Chef to instal OSSEC and use
ossec-authd to control key exchange. After a recent install, the Agent is
sending the alerts correctly, but OSSEC(ossec_agent_control) still reports
Thanks Dan.
The file was not present for this agent. When I created the file manually,
now it is being reported as Active.
This brings up another question. Is the presence of this file the only
thing needed to determine status of an Agent? File contains only basic
information about the
On Wed, Oct 8, 2014 at 3:09 PM, Abhi abhijittike...@gmail.com wrote:
Thanks Dan.
The file was not present for this agent. When I created the file manually,
now it is being reported as Active.
This brings up another question. Is the presence of this file the only thing
needed to determine
