Remove all mentions of it from the manager. Check in /var/ossec/queue. /var/ossec/queue/agent-info might have a file for it. /var/ossec/queue/diff /var/ossec/queue/syscheck /var/ossec/queue/rootcheck /var/ossec/etc/client.keys maybe?
You could also look at the code of the page you see it on, figure out which file it's getting the list from, and remove the mentions in that file. Also, search the mailing list archives, I feel like this comes up every so often. Often enough I keep wondering why I reply to wui mails. On Tue, Jul 19, 2011 at 7:01 PM, blacklight <[email protected]> wrote: > Hello Folks, > > I am trying to get a host that I had removed from OSSEC monitoring > through /var/ossec/bin/manage-agents completely off the list of hosts > in the OSSEC GUI - The host name still remains on the OSSEC GUI but > it's a ghost (or if you prefer, a zombie) - How do I wipe this ghost > out? > >
