Hmm -- I re-use IDs all the time. Did it when I had 30,000+ agents, and now
with only 10,000. You just have to delete the key (I don't like that they
are commented out) and make sure you remove the rids agent files in
/var/ossec/queue/ossec/rids - find the number of the agent you removed and
Thank you Victor for the response.
On Thursday, July 28, 2016 at 5:52:54 PM UTC-7, Victor Fernandez wrote:
>
> Hi Chanti.
>
> By default, OSSEC doesn't allow to add an agent with a removed agent's ID.
> When OSSEC adds a new agent, the information about it is written at
>
Hi Chanti.
By default, OSSEC doesn't allow to add an agent with a removed agent's ID.
When OSSEC adds a new agent, the information about it is written at
/var/ossec/etc/client.keys. When you remove an agent, the corresponding
line isn't removed but "tainted" with a "!" symbol.
If you want to
