It still shows connected. If I restart the OSSEC server, and not the agent, the agents should still be connected correct?
I didn't notice any strange messages, but I should probably turn on debugging again to check. The restart does not work because if it did it would be recorded both in the ossec.log and active-responses.log on the agent. I don't see these until after I manually restart the agent (/etc/init.d/ossec restart) On Thu, Feb 24, 2011 at 11:42 AM, dan (ddp) <[email protected]> wrote: > Doesn't sound intentional. Is the agent in a connected state when you > have this problem? > Are there any strange messages in the agent's ossec.log? > How do you know the restart doesn't work? > > On Thu, Feb 24, 2011 at 1:21 PM, jplee3 <[email protected]> wrote: > > Hey all, > > > > I've noticed that sometimes, after I restart the OSSEC server, and I > > try to issue the 'agent_control -R [id]' command to remotely restart > > an agent, it doesn't seem to work. I have to manually log on to the > > box where the agent is, restart OSSEC ('/etc/init.d/ossec restart') > > and then from there I am able to issue the restart via agent_control. > > > > Is this intentional? >
