Many thanks for this and the other reply from Chris Kolb.
I will check this out and am hopeful removing the agents from the
queue will address the problem. Let me ask the question: *should*
removing the agent via manage_agents or the perl remote agent
management remove the agent from the queue as well as the client.keys
file?
Bernard Golden
Chief Executive Officer, HyperStratus
www.hyperstratus.com
Author, "Virtualization for Dummies," Dummies Press, 2007
(T) 650 585 5309 (C) 650 400 3204 (F) 650 591 3805
Follow me on twitter: bernardgolden
On Jan 5, 2010, at 12:50 PM, Carter, Dennis A wrote:
Bernard,
Check in /var/ossec/queue/agent-info and see if the agents you remove
show up there. If so delete then and restart ossec and apache and
see if
they go away. I had the same problem a two or three months and found
that the delete agent left some information in another directory that
the ossec-wui was pulling information from.
Thanks
Dennis Carter
Business Technology Services
727-464-4527
-----Original Message-----
From: [email protected] [mailto:[email protected]]
On Behalf Of Bernard Golden
Sent: Tuesday, January 05, 2010 11:58 AM
To: [email protected]
Subject: Re: [ossec-list] Ossec Webui Displaying Removed Agents
I have restarted both ossec and apache and ossec-wui continues to
display agents that have been removed (are no longer in the
client.keys file).
Bernard Golden
Chief Executive Officer, HyperStratus
www.hyperstratus.com
Author, "Virtualization for Dummies," Dummies Press, 2007
(T) 650 585 5309 (C) 650 400 3204 (F) 650 591 3805
Follow me on twitter: bernardgolden
On Jan 5, 2010, at 6:31 AM, Carter, Dennis A wrote:
Bernard,
Did you try restarting the httpd service? Try restarting the httpd
service and see if that removed the agents that have been removed.
thanks
Dennis Carter
Business Technology Services
727-464-4527
-----Original Message-----
From: [email protected] [mailto:ossec-
[email protected]]
On Behalf Of Bernard Golden
Sent: Monday, January 04, 2010 1:55 PM
To: ossec-list
Subject: [ossec-list] Ossec Webui Displaying Removed Agents
I am seeing OSSEC WUI displaying agents that have been removed from
the OSSEC Manager as "Inactive." Is there a way to get removed agents
off of the OSSEC WUI display?
Here is the scenario:
A server that has OSSEC Agent installed and communicating with OSSEC
Manager is being shutdown. This is a very dynamic environment, and
the
server running the OSSEC agent will not be reinstantiated with the
same IP address. Therefore, when the server is reinstantiated, it re-
registers with the OSSEC Manager and successfully is listed with the
new IP address, new ID, etc.
As part of the shutdown process, the ossec-batch-manager.pl on the
Manager is called to remove the OSSEC Agent listing from the Manager.
This is accomplished successfully, with the Agent no longer listed in
the Manager's client.keys file.
Nevertheless, OSSEC WUI continues to list the Agent in the "Available
Agents" in red with a note of "Inactive."
This results in the same server being listed twice: once as the new
active server, and once as the removed "Inactive" server.
Since the OSSEC Agent associated with the previous server
instantiation is removed permanently, I would prefer the WEBUI
listing
to be removed, rather than showing an "Inactive" status. Restarting
OSSEC Manager does not affect the "Inactive" listing for the agent in
WEBUI, nor does restarting Apache.
Is there a way to get the removed agents to be no longer listed on
the
WEBUI interface?
Many thanks.
