Hi, I checked and the only thing I can find is that every second this messages appear:
2013/11/19 21:12:05 ossec-authd: INFO: New connection from x.y.c.10 2013/11/19 21:12:06 ossec-authd: ERROR: SSL read error (-1) 2013/11/19 21:12:07 ossec-authd: ERROR: SSL Accept error (0) 2013/11/19 21:12:07 ossec-authd: INFO: New connection from x.y.c.11 2013/11/19 21:12:08 ossec-authd: ERROR: SSL read error (-1) 2013/11/19 21:12:08 ossec-authd: ERROR: SSL Accept error (0) 2013/11/19 21:12:08 ossec-authd: ERROR: SSL Accept error (0) 2013/11/19 21:12:08 ossec-authd: INFO: New connection from x.y.c.11 2013/11/19 21:12:08 ossec-authd: INFO: New connection from x.y.c.10 2013/11/19 21:12:09 ossec-remoted(1213): WARN: Message from x.y.c.11 not allowed. Could this be related? On Thursday, November 14, 2013 1:38:45 PM UTC-3, Michael Starks wrote: > > On 2013-11-14 9:55, [email protected] <javascript:> wrote: > > Hi, I have 5 servers sharing the same NFS folder for /var/ossec, and > > it seems to be working. I've inherited this architecture. > > > > Right now, we have about 3000 clients that connect to an F5 vip, and > > then each client reports to this VIP. In the vip are 5 servers sharing > > the same /var/ossec nfs folder. > > > > My question is, does this architecture work? I mean, Im having issues > > with some clients not connecting and I'm not sure that the correlation > > would work properly, it depends if all the ossec correlation reads > > always from disk and does not save information to memory. > > The only thing I can think of that might be a problem is the rids. Check > ossec.log to see if anything is being denied. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
