Greetings: We currently are testing OSSEC 1.3 on 25 servers including 3 Window 2003 servers.
Two of the Window 2003 servers are running regular 32-bit Windows 2003 server; but the third one is running 64-bit plus also using the storage server edition. All three are to the latest Microsoft patch level including the patches released yesterday, 8-14-2007. The 64-bit Window server agent regularly (typically within a few hours of starting the agent) disconnects from the server. In the ossec log on the agent side, every time there is a disconnect I notice lines as follows: 2007/08/15 10:33:51 ossec-agent: Event count after '20000': 4139566- >3496696 (84%) 2007/08/15 11:45:53 ossec-agent: Server unavailable. Setting lock. 2007/08/15 11:45:56 ossec-agent: Server responded. Releasing lock. 2007/08/15 12:31:26 ossec-agent: Server unavailable. Setting lock. 2007/08/15 12:31:29 ossec-agent: Server responded. Releasing lock. 2007/08/15 13:03:59 ossec-agent: Server unavailable. Setting lock. 2007/08/15 13:04:02 ossec-agent: Server responded. Releasing lock. 2007/08/15 13:35:32 ossec-agent: Server unavailable. Setting lock. 2007/08/15 13:35:35 ossec-agent: Server responded. Releasing lock. Is there anything I can do on my end to improve how long the agent stays connected? Thank you.
