As the server machine and the agent machine are on the same network segment, so these two machines do not route through routers. The ttl for these two machines are 64 and 255 which are fine. How can I know if the agents receive disconnected notices?
On Dec 23, 10:55 pm, Nathaniel Bentzinger <nbentzin...@archer- group.com> wrote: > Are you receiving agents disconnected notices? Is this just for remote > agents or internal ones as well? > > I know that my cisco 2811's IPS old firmware was disconnecting my UDP > connections prematurely. Perhaps your router's TTL needs to be increased for > remote agents? > > > > -----Original Message----- > From: [email protected] [mailto:[email protected]] On > Behalf Of Henry > Sent: Thursday, December 23, 2010 4:16 AM > To: ossec-list > Subject: [ossec-list] Unstable ossec connections > > I have been setting up with a ossec server and a ossec agent installed. I > can use the syscheck_control -lc command on server side to see the agent. > But usually after several hours without disruptions, the syscheck_control -lc > command cannot see the agents. > The only thing I can do is to restart the ossec agent and then restart the > ossec server, then I can locate the agent using the syscheck_control -lc > command. Any help is appreciated.- Hide quoted text - > > - Show quoted text -
