Hi Kirk, It can be two things: Packet loss or the scan was already running on that agent when you issued the command. How busy are these servers? Can you try running tcpdump (on both the manager and agent) while you run it? Just to check if the agent is receiving the message...
Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Fri, Dec 11, 2009 at 10:49 AM, Kirk Frankovich <[email protected]> wrote: > Dan, > > No, nothing that I can see. Both logs (the agent that starts and the agent > that doesn't) look normal from what I can tell. Active Response is enabled > and all agents show as connected and active. If I tail the agent logs, I see > what I normally would expect, I just have to reissue the agent_control > command a few times. > > Is there any debugging I can turn on to see what is actually happening when I > issue the command? > > Thank you, > Kirk > > -----Original Message----- > From: [email protected] [mailto:[email protected]] On > Behalf Of [email protected] > Sent: Thursday, December 10, 2009 8:11 PM > To: [email protected] > Subject: RE: [ossec-list] Possible agent_control bug > > Anything in the logs on the server or misbehaving agents? Is active reponse > enabled on the agents? Did agent 002 successfully connect to the server? > dan > > Sent from my Nokia phone > -----Original Message----- > From: Kirk Frankovich > Sent: 12/10/2009 5:19:04 PM > Subject: [ossec-list] Possible agent_control bug > > I filed a report on the uservoice site, but I wanted to post this to the > mailing list to see if anyone else has seen this or knows of this. > > This morning I deployed OSSEC live for the first time. I installed the > server and connected two agents. > > Once everything was up and communicating, I ran ./agent_control -r -u > 001 and ./agent_control -r -u 002 from the server to kick off a scan on > my two agents (I disable scan at startup). > > Within a minute or two, agent 001 was running a scan, but 002 was not. > After 30 minutes, 002 still had not kicked off a scan, so I reran the > agent_control command. The second command didn't appear to do anything > either (though I only waited a minute or two). So I ran it about five > times in a row. Finally agent 002 kicked off a scan. > > This afternoon I added some additional agents and ran into the same > thing. > > Can anyone help with this? > > -- > Confidentiality Notice: This e-mail, including attachments, may include > confidential and/or proprietary information, and may be used only by the > person or entity to which it is addressed. If the reader of this e-mail is > not the intended recipient or his or her authorized agent, the reader is > hereby notified that any dissemination, distribution, copying or taking any > action in reliance upon this information is prohibited. If you have received > this e-mail in error, please notify the sender by replying to this message > and delete this e-mail immediately. > This message was scanned by ESVA and is believed to be clean. > > > > > -- > This message was scanned by ESVA and is believed to be clean. > > > -- > Confidentiality Notice: This e-mail, including attachments, may include > confidential and/or proprietary information, and may be used only by the > person or entity to which it is addressed. If the reader of this e-mail is > not the intended recipient or his or her authorized agent, the reader is > hereby notified that any dissemination, distribution, copying or taking any > action in reliance upon this information is prohibited. If you have received > this e-mail in error, please notify the sender by replying to this message > and delete this e-mail immediately. > This message was scanned by ESVA and is believed to be clean. > > >
