Hi Michael,
This will only happen when the agent is not receiving a reply from the server. Did anything happened after that, or is it still locked? The server should have reported the agent as disconnected, did it do that? Can you check the connectivity between the them? Make sure that no firewall rule was added (I once had an ossec server shunning an agent and had the same behavior). Hope it helps. -- Daniel B. Cid dcid ( at ) ossec.net On 3/18/07, Michael Starks <[EMAIL PROTECTED]> wrote:
I'm having a problem where, after a certain undetermined amount of time an OpenBSD 3.8 agent dies. Both server and agent are at OSSEC v1.1. The server logs don't show anything but the agent logs do. Here are the logs from the agent: 2007/03/11 10:00:19 ossec-logcollector(1950): Analyzing file: '/var/www/logs/access_log'. 2007/03/11 10:00:19 ossec-logcollector(1950): Analyzing file: '/var/www/logs/error_log'. 2007/03/11 10:00:19 ossec-logcollector: Started (pid: 10725). 2007/03/12 04:04:15 ossec-agentd: Event count after '20000': 4435231->3581256 (80%) 2007/03/14 10:52:44 ossec-agentd: Event count after '20000': 3705601->3236048 (87%) 2007/03/16 15:44:31 ossec-agentd: Event count after '20000': 3713634->3242144 (87%) 2007/03/16 22:20:50 ossec-agentd: Server unavailable. Setting lock. 2007/03/16 22:20:52 ossec-agentd: Process locked. Waiting for permission... 2007/03/16 22:22:23 ossec-logcollector: Process locked. Waiting for permission... 2007/03/17 00:30:07 ossec-syscheckd: Process locked. Waiting for permission... Any ideas?
