I knew this. Of course I've known this for a while and still managed to spend 20 minutes troubleshooting this a week or two ago. :P dan
On Wed, Apr 13, 2011 at 2:09 PM, Bill <[email protected]> wrote: > (subtitle: I Learned Something New Today) > > I reinstalled a Windows agent, re-used the key, and (of course) it > couldn't connect: > > 2011/04/13 11:40:39 ossec-remoted: WARN: Duplicate error: global: > 0, local: 78, saved global: 68, saved local:3938 > 2011/04/13 11:40:39 ossec-remoted(1407): ERROR: Duplicated counter > for '<agent>'. > > I found http://www.ossec.net/wiki/Errors:DuplicateError. > > The article says to delete every file in rids on the server. If > you've only reinstalled a client, just delete the rids file > corresponding to the client you've reinstalled. e.g.., if you > reinstalled the client with ID 001, then delete the file, /var/ossec/ > queue/rids/001 > > Probably 90% of you knew this but what the heck - this is my little > contribution back for us ossec neophites. :-) I hope someone finds > it useful. >
