Thomas, if the IP address of a client changes, the only correct way is to create a new key for this client. Manually editing the client.keys file will result in the behaviour you described.
Cheers, Wim On Mon, Dec 14, 2009 at 9:06 AM, Thomas Stather <[email protected]> wrote: > Hello Guys > > > I have a strange problem with my list_agents command (i run OSSEC 2.2). I > recently had to change the client.keys file manually to change an ip address > (i didn't delete and readd the client using manage_agents). When i now run > list_agents -a i see the machine with its new IP address but when i run > list_agents -n i see the old IP address as not connectet (which makes > sense). In addition, the OSSEC WUI shows me the old IP address of the > machine as inactive. > What can i do about this, is there some tempfile beside of client.keys which > stores this information? > > > Best Regards > > Thomas > > -- > Thomas Stather, Fraunhofer SIT > Abteilung PSS > Zimmer 64 > Rheinstrasse 75, 64295 Darmstadt, Germany > Tel: +49 (0) 6151 86960058 > http://www.sit.fraunhofer.de > > -- Wim Remes Security Afficionado
