Hi Roch, OSSEC tries to read the whole event log until it reaches the end of it, so it may take a few minutes in your case. After that, it should work normally. If you restart the agent, it will go through the whole event log again, causing the delay to happen.
Try waiting a few minutes to see if it finishes. If not, please send the ossec.log from the agent to us too. Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Jan 8, 2008 1:56 PM, Roch <[EMAIL PROTECTED]> wrote: > > Hi, > > Running Server version 1.4 on Redhat EL 4 64-Bit. > > Have a question about a windows agent. > > From the windows agent log it seems to be stuck checking the security > event log. This is the first time it has run as it was only recently > installed. The event logs are 100mb each, is it normal for it to take > a while, also the agent appears as disconnected in the Web GUI while > this is happening. Restarting the agent forces it to reconnect but it > eventually disconnects and the logs again show it is in the process of > checking the event logs on the windows system. > > Roch >
