The web-ui looks inside /var/ossec/queue for information on agents, so you have to remove from there as well..
thanks, -- Daniel B. Cid http://dcid.me On Wed, May 2, 2012 at 8:56 PM, dan (ddp) <[email protected]> wrote: > Do the deleted agents show up in the ossec output (like the list_agents > application)? > If not, it's a wui thing. And if there are alerts from those deleted agents, > forgetting the agent would be kind of silly. > > On May 2, 2012 7:52 PM, "Andy Cockroft (andic)" <[email protected]> wrote: >> >> After I delete an agent – either using manage_agents or manually editing >> client.keys, the entry persists in OSSEC WUI. >> >> >> >> I have even tried deleting all of client.keys, all queue and rids entries >> and starting again – these “ghost” entries still remain >> >> >> >> I’ve searched high and low, but still can’t find a way or getting these to >> disappear short of uninstalling and reinstalling. >> >> >> >> Any ideas? >> >> >> >> Andy >> >> >> >>
