I just investigated this as I've been working on the eventchannel code quite a bit. The eventchannel stuff will both bookmark the last location so the agent can pick up again where it left off. Also, if the manager is down and seen as "disconnected" by the agent than it will also behave the same way as the evnetlog code does and wait for it to come back to life before sending more log data.
-- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
