Yes, that is the case for me. Have you had any issues trying to issue an Active Response from the server to an agent using `agent_control` after restarting the server?
I'm wondering what would cause this to happen for me. On Thu, Feb 24, 2011 at 12:04 PM, dan (ddp) <[email protected]> wrote: > On Thu, Feb 24, 2011 at 2:54 PM, Jeremy Lee <[email protected]> wrote: > > It still shows connected. If I restart the OSSEC server, and not the > agent, > > the agents should still be connected correct? > > > > Correct. Whenever I restart my manager and check all agents that were > connected are still connected. > > > > I didn't notice any strange messages, but I should probably turn on > > debugging again to check. > > > > The restart does not work because if it did it would be recorded both in > the > > ossec.log and active-responses.log on the agent. I don't see these until > > after I manually restart the agent (/etc/init.d/ossec restart) > > > > > > > > > > On Thu, Feb 24, 2011 at 11:42 AM, dan (ddp) <[email protected]> wrote: > >> > >> Doesn't sound intentional. Is the agent in a connected state when you > >> have this problem? > >> Are there any strange messages in the agent's ossec.log? > >> How do you know the restart doesn't work? > >> > >> On Thu, Feb 24, 2011 at 1:21 PM, jplee3 <[email protected]> wrote: > >> > Hey all, > >> > > >> > I've noticed that sometimes, after I restart the OSSEC server, and I > >> > try to issue the 'agent_control -R [id]' command to remotely restart > >> > an agent, it doesn't seem to work. I have to manually log on to the > >> > box where the agent is, restart OSSEC ('/etc/init.d/ossec restart') > >> > and then from there I am able to issue the restart via agent_control. > >> > > >> > Is this intentional? > > > > >
