Hey, When the agent detects that the manager is offline, it will stop processing new events, and will only resume reading them when the manager is back up.
So, those events will not be lost. However, we don't queue them in memory, we just keep the file descriptors open and waiting to be read again. If the manager goes offline for a while (or the agent is rebooted), you lose everything in the middle... Using TCP wouldn't help on those situations anyway.. Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Wed, Feb 17, 2010 at 1:33 PM, roger <[email protected]> wrote: > +1 > > Is there a way to have OSSEC deliver over TCP rather than UDP? > > On Feb 16, 1:39 am, Stefano Pedretti <[email protected]> > wrote: >> Hi all, >> i want known if OSSEC keep events happened when manager is offline/ >> unreacheable. >> I known there is a lock status but seems that some events can be >> losts. >> >> Is this true? There is a way to avoid event losses in lack of network >> cases? >> >> thank you >
