On Thu, Feb 24, 2011 at 2:54 PM, Jeremy Lee <[email protected]> wrote: > It still shows connected. If I restart the OSSEC server, and not the agent, > the agents should still be connected correct? >
Correct. Whenever I restart my manager and check all agents that were connected are still connected. > I didn't notice any strange messages, but I should probably turn on > debugging again to check. > > The restart does not work because if it did it would be recorded both in the > ossec.log and active-responses.log on the agent. I don't see these until > after I manually restart the agent (/etc/init.d/ossec restart) > > > > > On Thu, Feb 24, 2011 at 11:42 AM, dan (ddp) <[email protected]> wrote: >> >> Doesn't sound intentional. Is the agent in a connected state when you >> have this problem? >> Are there any strange messages in the agent's ossec.log? >> How do you know the restart doesn't work? >> >> On Thu, Feb 24, 2011 at 1:21 PM, jplee3 <[email protected]> wrote: >> > Hey all, >> > >> > I've noticed that sometimes, after I restart the OSSEC server, and I >> > try to issue the 'agent_control -R [id]' command to remotely restart >> > an agent, it doesn't seem to work. I have to manually log on to the >> > box where the agent is, restart OSSEC ('/etc/init.d/ossec restart') >> > and then from there I am able to issue the restart via agent_control. >> > >> > Is this intentional? > >
