I "reinstalled" (2.3) and set the max agents again (was 1024) to 2048, clients started connecting again, when we first added over 254 agents we noticed the error and used http://www.ossec.net/wiki/Errors:LargeNumberAgents to up the agents, all was well. Haven't seen the error in the log since, and command history shows when we upgraded from 2.2 to 2.3 we ran the command at that time as well, not sure what to make of this "fix" as there was no indication that we exceeded 1024 hosts (only 700+ keys have been made) but it's started working again. The ulimit was also set to 1024, and now is upped to 2048 just for good measure. I've already seen a few hosts connect and disconnect like I've outlined in the past. We would still like to re-do the server, so if there is an easy way import the current DB into the next build, that would be a life saver. -rich
On Mon, May 17, 2010 at 1:05 PM, Rich Rumble <[email protected]> wrote: > I can't figure out why no agent is connecting to my server, new or old. I'd > like to back up the keys DB and remake the server, and restore the keys. I > do not want to generate 500+ keys by hand (again) and the bulk scripts > haven't worked. Is there a way to do this, I see agents trying to contact > the sever, but the server never reports them as connected. The Server is 2.3 > the agents are 2.2 and 2.3. I have another 200 keys that are not in use yet, > so 700 in total. I want to swap the hardware and all to eliminate any doubt > about that since we had our first ossec issues on Jan-1st. > -rich >
