In this case, I've had to remove the agent's file from 
/var/ossec/queue/agent-info/ and then it no longer appears in the web UI.

Chris Kolb
Manager of Information Security
GDSX, Ltd. 
Phone: 972-612-7121
Fax: 972-612-7021

Confidentiality Notice:  This e-mail contains information that is 
confidential.  It is intended for the exclusive use of the individual or entity 
to whom it is addressed.  If you are not the named recipient, disclosure or 
distribution of the information transmitted herewith is strictly prohibited and 
may be subject to legal restriction or sanction.  Please notify the sender, by 
return e-mail or telephone, of any unintended recipients and delete the 
original message without making any copies.


-----Original Message-----
From: [email protected] [mailto:[email protected]] On 
Behalf Of Bernard Golden
Sent: Tuesday, January 05, 2010 10:58 AM
To: [email protected]
Subject: Re: [ossec-list] Ossec Webui Displaying Removed Agents

I have restarted both ossec and apache and ossec-wui continues to  
display agents that have been removed (are no longer in the  
client.keys file).



Bernard Golden
Chief Executive Officer, HyperStratus
www.hyperstratus.com
Author, "Virtualization for Dummies," Dummies Press, 2007
(T) 650 585 5309 (C) 650 400 3204 (F) 650 591 3805
Follow me on twitter: bernardgolden


On Jan 5, 2010, at 6:31 AM, Carter, Dennis A wrote:

>
>
> Bernard,
>
> Did you try restarting the httpd service? Try restarting the httpd
> service and see if that removed the agents that have been removed.
>
> thanks
> Dennis Carter
> Business Technology Services
> 727-464-4527
> -----Original Message-----
> From: [email protected] [mailto:[email protected]]
> On Behalf Of Bernard Golden
> Sent: Monday, January 04, 2010 1:55 PM
> To: ossec-list
> Subject: [ossec-list] Ossec Webui Displaying Removed Agents
>
> I am seeing OSSEC WUI displaying agents that have been removed from
> the OSSEC Manager as "Inactive." Is there a way to get removed agents
> off of the OSSEC WUI display?
>
> Here is the scenario:
>
> A server that has OSSEC Agent installed and communicating with OSSEC
> Manager is being shutdown. This is a very dynamic environment, and the
> server running the OSSEC agent will not be reinstantiated with the
> same IP address. Therefore, when the server is reinstantiated, it re-
> registers with the OSSEC Manager and successfully is listed with the
> new IP address, new ID, etc.
>
> As part of the shutdown process, the ossec-batch-manager.pl on the
> Manager is called to remove the OSSEC Agent listing from the Manager.
> This is accomplished successfully, with the Agent no longer listed in
> the Manager's client.keys file.
>
> Nevertheless, OSSEC WUI continues to list the Agent in the "Available
> Agents" in red with a note of "Inactive."
>
> This results in the same server being listed twice: once as the new
> active server, and once as the removed "Inactive" server.
>
> Since the OSSEC Agent associated with the previous server
> instantiation is removed permanently, I would prefer the WEBUI listing
> to be removed, rather than showing an "Inactive" status. Restarting
> OSSEC Manager does not affect the "Inactive" listing for the agent in
> WEBUI, nor does restarting Apache.
>
> Is there a way to get the removed agents to be no longer listed on the
> WEBUI interface?
>
> Many thanks.

Attachment: PGP.sig
Description: PGP signature

Reply via email to