Alright, I found what the issue was, multiple duplicates,
The fix: go into /var/ossec/queue/rids pick the agent number which is disconnected, edit it, remove all inside, pick sender_counter, clean everything inside, service ossec restart, Worked, br On Wednesday, 3 August 2011 17:47:51 UTC+2, jplee3 wrote: > > Hi all, > > I've been noticing that after I restart the OSSEC server, the Agents > don't seem to re-connect right away. Is this expected behavior? We are > constantly making changes to rules, etc on the server which in turn > also affect active response. I noticed this when I restarted the > server and then tried using agent_control -R to restart some agents - > the command didn't seem to propagate until after I manually restarted > the agent itself. > > Do the agents *eventually* reconnect like after 30 minutes (per OSSEC > keepalives)? > > On that note, is there a way to change the keepalive timeframe? I > thought I read it was 30mins somewhere. I also seem to recall being > able to modify the source for this, but it would be nice if there were > a way to do it in the configuration files. > > Thanks -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
