Hi Rich, Strange issue for sure... I have not heard of anyone else having problems during the 2010 change and I don't think we have anything in the code that would be affected by the year change.
What is showing up on the manager's log? Can you check if it has any partition full or anything like that? For all the agents to be affected, I would guess an issue on the manager side... Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Thu, Jan 7, 2010 at 11:54 AM, Rich Rumble <[email protected]> wrote: > Still on going issues here... I'm getting emails every 2 minutes > listing > all the host's disconnecting from the server. They seem to be going in > order of their number, the last 160 disconnects first, then 159 etc.. > all > the way down to 001, then all host's start to come back in the > opposite > direction, 001, then 002 etc... The server has been rebooted, I cannot > reboot > the clients, but their services have been restarted, keys copied > over... > When they are "connected" after the whole cycle they never email about > being connected, their status just shows connected: > /var/ossec/bin/agent_control -lc shows the connected boxes > ... Again the server is running 2.3 code and most clients are 2.2 > No changes for the past 6 months other than upgrading to 2.3 on the > server a few weeks ago. The clients are showing the issues I stated > previously, again > all of their trouble began at the roll over to 2010. > >> 2010/01/02 01:43:08 ossec-agent: Error waiting mutex (timeout). >> 2010/01/02 01:44:53 ossec-agent: Error waiting mutex (timeout). >> 2010/01/02 01:46:38 ossec-agent: Error waiting mutex (timeout). >> 2010/01/02 01:48:23 ossec-agent: Error waiting mutex (timeout). >> 2010/01/02 01:50:08 ossec-agent: Error waiting mutex (timeout). >> 2010/01/02 01:50:17 ossec-agent: INFO: Trying to connect to server >> (10.2.2.6:1514). >> and on and on. >> I've restarted the server, restarted the agents to no avail. Some are >> now reporting duplicate counter >> errors, and deleting the rids files is not fixing them this time >> around. >> The server is 2.3 and most agents are 2.2 windows only. >
