Hello and thank you in advance for any help given...
I have two issues and not sure if they are related.
First, following Daniel's advice (thank you Daniel) we set
"setmaxagents" to 4096 and compiled cleanly. However, after adding
the first 1024 clients we now get this error:
- Adding a new agent (use '\q' to return to the main menu).
Please provide the following:
* A name for the new agent: * The IP Address of the new
agent: * An ID for the new agent[1025]:
** ID '1025' already present. They must be unique.
Looking at our client.keys file there isn't an ID of 1025.
Second, looking at our log file it appears that 'remoted' is not happy
----
2009/06/21 22:51:58 ossec-remoted: INFO: Started (pid: 12344).
2009/06/21 22:51:58 ossec-remoted(1501): ERROR: No IP or network
allowed in the access list for syslog. No reason for running it.
Exiting.
2009/06/21 22:51:58 ossec-rootcheck: Rootcheck disabled. Exiting.
2009/06/21 22:51:58 ossec-syscheckd: WARN: Rootcheck module disabled.
2009/06/21 22:51:58 ossec-monitord: INFO: Started (pid: 12354).
2009/06/21 22:51:58 ossec-remoted: INFO: Started (pid: 12346).
2009/06/21 22:51:58 ossec-remoted(4111): INFO: Maximum number of
agents allowed: '4096'.
2009/06/21 22:51:58 ossec-remoted(1410): INFO: Reading authentication
keys file.
2009/06/21 22:51:59 ossec-syscheckd: socketerr (not available).
2009/06/21 22:51:59 ossec-syscheckd(1224): ERROR: Error sending
message to queue.
2009/06/21 22:51:59 ossec-logcollector: socketerr (not available).
2009/06/21 22:51:59 ossec-logcollector(1224): ERROR: Error sending
message to queue.
2009/06/21 22:52:02 ossec-syscheckd: INFO: Started (pid: 12350).
2009/06/21 22:52:04 ossec-logcollector(1950): INFO: Analyzing file: '/
var/log/messages'.
2009/06/21 22:52:04 ossec-logcollector(1950): INFO: Analyzing file: '/
var/log/mail.info'.
2009/06/21 22:52:04 ossec-logcollector: INFO: Started (pid: 12340).
2009/06/21 22:53:38 ossec-syscheckd: INFO: Ending syscheck scan (db).
2009/06/21 22:59:31 ossec-syscheckd: INFO: Starting syscheck scan
(db).
2009/06/21 23:09:15 agent_control(1207): ERROR: Unable to switch to
group: 'ossec'.
2009/06/21 23:09:30 agent_control(1210): ERROR: Queue '/queue/alerts/
ar' not accessible: 'Connection refused'.
2009/06/21 23:09:30 agent_control(1301): ERROR: Unable to connect to
active response queue.
Here is our 'ossec-init.conf'
os...@n1pvir006 > cat ossec-init.conf
DIRECTORY="/opt/ossec"
VERSION="v2.0"
DATE="Wed May 13 12:18:41 EDT 2009"
TYPE="server"
So, should we be able to go beyond the 1024 clients currently
configured?
And, is the 'remoted(1501): ERROR" something fixable?
Please let me know what other information would be helpful in
resolving this issue.
