Check the ossec.log on the agents that disconnect and the manager for information on the agents that disconnect. You can also run the manager's processes in debug mode (-d) for more verbose messages.
On Thu, Dec 23, 2010 at 4:15 AM, Henry <[email protected]> wrote: > I have been setting up with a ossec server and a ossec agent > installed. I can use the syscheck_control -lc command on server side > to see the agent. But usually after several hours without > disruptions, the syscheck_control -lc command cannot see the agents. > The only thing I can do is to restart the ossec agent and then restart > the ossec server, then I can locate the agent using the > syscheck_control -lc command. Any help is appreciated.
