I am seeing OSSEC WUI displaying agents that have been removed from the OSSEC Manager as "Inactive." Is there a way to get removed agents off of the OSSEC WUI display?
Here is the scenario: A server that has OSSEC Agent installed and communicating with OSSEC Manager is being shutdown. This is a very dynamic environment, and the server running the OSSEC agent will not be reinstantiated with the same IP address. Therefore, when the server is reinstantiated, it re- registers with the OSSEC Manager and successfully is listed with the new IP address, new ID, etc. As part of the shutdown process, the ossec-batch-manager.pl on the Manager is called to remove the OSSEC Agent listing from the Manager. This is accomplished successfully, with the Agent no longer listed in the Manager's client.keys file. Nevertheless, OSSEC WUI continues to list the Agent in the "Available Agents" in red with a note of "Inactive." This results in the same server being listed twice: once as the new active server, and once as the removed "Inactive" server. Since the OSSEC Agent associated with the previous server instantiation is removed permanently, I would prefer the WEBUI listing to be removed, rather than showing an "Inactive" status. Restarting OSSEC Manager does not affect the "Inactive" listing for the agent in WEBUI, nor does restarting Apache. Is there a way to get the removed agents to be no longer listed on the WEBUI interface? Many thanks.
