Could you compare the information in /var/ossec/queue/agent-info/ with the reported agent status to see if both are in error?
On Wednesday, October 3, 2012 6:31:25 AM UTC-7, PAL wrote: > > After a some issue in network ossec client lost connection to server. A > message "Agent disconnected" was generated, client host mark as "inactive". > It's good. But after network restore status did not return to "active", > even ossec server got messages from client and generate alerts (I wait over > two hours). After ossec server restart all statuses ok in few minutes. > > >
