Hello, I have a quick question regarding the 'disconnected' status. What constitutes an agent being disconnected? How long after the last keep alive does it mark an agent as disconnected and is there a way to change this value?
I'm looking to alert on rule 504 (agent disconnected) specifically, and when manually shutting down the agent on the remote host it never switched from Active => Disconnected. Thanks. -Tim -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
