Run the following command to see which agent(s) were not "Active". In particular, look for the entry that says "Never connected". ossec/bin/agent_control -l
On Thursday, September 26, 2013 10:48:22 AM UTC-7, BP9906 wrote: > > 2013/09/26 10:41:38 ossec-remoted(1403): ERROR: Incorrectly formated > message from 'any'. > > We have an agent that keeps flagging this and I obviously have no idea who > it is because we have about 30 agents setup with 'any' for the IP. > > > Any suggestions to locating this? > > Can I enable debug and it will log the source IP? > > > Thank you > > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
