All agents with the issue are 2.2, I've not been able to find tell of this issue prior to today. http://www.ossec.net/announcements/v2.3-2009-12-07.txt http://www.ossec.net/wiki/FAQ#Section_3_.28When_the_unexpected_happens.29 This has to be the 3rd time on the list I've mentioned the issue...
On Tue, Mar 9, 2010 at 7:31 AM, Daniel Cid <[email protected]> wrote: > Hey, > > What version of OSSEC are you using? If you are getting this alerts is > because the > manager didn't see any event from the agent for a while. If the agent > wasn't shut down > and starts sending events back again, the manager will not report that the > agent > has been reconnected... > > *if you are on version 2.2 on Windows, we fixed some relevant bugs > related to that ( > losing the connection and not reconnecting). > > Thanks, > > -- > Daniel B. Cid > dcid ( at ) ossec.net > > On Mon, Mar 8, 2010 at 5:30 PM, Rich Rumble <[email protected]> wrote: > > I have the same issue, no fix in sight, as I can't track down the problem > > yet. All day long my host's come and go, except for host's I've added > after > > the problem began, none of them are having the issue. They connect back > up > > with no alert in the log, I only receive disconnects notices, never the > > reconnect notices unless the service on the host has been restarted. > > Restarting the server does nothing, upgrading, and trying the > > upgrade/reinstall again also changed nothing. > > The logs, other than the disconnects, are accurate on the ossec server, > so > > I've been ignoring the disconnections and checking the log on the server > and > > not my email alerts.... > > > > On Mon, Mar 8, 2010 at 10:18 AM, Dimitri <[email protected]> wrote: > >> > >> Dears. > >> > >> I have the following problem with ossec. Constantly loses connectivity > >> between the server and clients, the server suggest me "inactive", but > the > >> client tells me that its status is "active". > >> To fix this daily I restart the ossec Server services, and this > generates > >> events audit must report and are not in compliance because this is a > >> problem, not an isolated incident. > >> > >> any idea which is the problem.? > >> Dimitri.- > >> http://deoxyt2.livejournal.com > >> http://anabalon.clan.su > >> OpenBSD - Free, Functional & Secure > >> > >> > >> > > > > >
