(subtitle: I Learned Something New Today) I reinstalled a Windows agent, re-used the key, and (of course) it couldn't connect:
2011/04/13 11:40:39 ossec-remoted: WARN: Duplicate error: global: 0, local: 78, saved global: 68, saved local:3938 2011/04/13 11:40:39 ossec-remoted(1407): ERROR: Duplicated counter for '<agent>'. I found http://www.ossec.net/wiki/Errors:DuplicateError. The article says to delete every file in rids on the server. If you've only reinstalled a client, just delete the rids file corresponding to the client you've reinstalled. e.g.., if you reinstalled the client with ID 001, then delete the file, /var/ossec/ queue/rids/001 Probably 90% of you knew this but what the heck - this is my little contribution back for us ossec neophites. :-) I hope someone finds it useful.
