Michael,
You may have to CD to /var/ossec/queue/rids. In the RIDS file you see the numbers that correspond to the agents. Check and see if the numbers for the agents you removed are still listed in the RIDS file if so delete then out. You can also try restarting the HTTPD service on your system so the web UI will get a current update of agents from OSSEC. Hope this helps Dennis Carter Pinellas County Govt Business Technology Services 727-464-4527 ________________________________ From: [email protected] [mailto:[email protected]] On Behalf Of Michael Barrett Sent: Tuesday, August 17, 2010 9:23 AM To: [email protected] Subject: [ossec-list] sensors showing up in UI after removed I have removed several sensors from the server using manage_agent and they still appear on the web ui Any suggestions on how to remove these ghosts? ____________________________________________ Michael Barrett <mailto:[email protected]> | Information Security Analyst - Lead | Mortgage Guaranty Insurance Corporation <http://www.mgic.com/> 270 E. Kilbourn Ave. | Milwaukee, WI 53202 USA | * 1.414.347.6271 | 7 1.888.601.4440 | * [email protected] <mailto:[email protected]> "Accomplishing the impossible means only that your boss will add it to your regular duties" Doug Larson This message is intended for use only by the person(s) addressed above and may contain privileged and confidential information. Disclosure or use of this message by any other person is strictly prohibited. If this message is received in error, please notify the sender immediately and delete this message.
