Hi Again Dan
...just found it - your suggestion was spot on I removed the offending entries from queue/agent-info and now all tickety-boo Andy From: [email protected] [mailto:[email protected]] On Behalf Of Andy Cockroft (andic) Sent: Thursday, 3 May 2012 12:35 p.m. To: [email protected] Subject: RE: [ossec-list] OSSEC Doesn't Forget ! Hi Dan They show up in list_agents -a Cheers Andy From: [email protected] [mailto:[email protected]] On Behalf Of dan (ddp) Sent: Thursday, 3 May 2012 11:56 a.m. To: [email protected] Subject: Re: [ossec-list] OSSEC Doesn't Forget ! Do the deleted agents show up in the ossec output (like the list_agents application)? If not, it's a wui thing. And if there are alerts from those deleted agents, forgetting the agent would be kind of silly. On May 2, 2012 7:52 PM, "Andy Cockroft (andic)" <[email protected]> wrote: After I delete an agent - either using manage_agents or manually editing client.keys, the entry persists in OSSEC WUI. I have even tried deleting all of client.keys, all queue and rids entries and starting again - these "ghost" entries still remain I've searched high and low, but still can't find a way or getting these to disappear short of uninstalling and reinstalling. Any ideas? Andy
