On Tue, Jan 27, 2015 at 5:09 PM, Todd Courtnage <[email protected]> wrote: > Thanks Michael. > > After copying the contents of a client.keys from an agent into the server > client.keys file and removing the rids on the agent, I was able to > successfully get them to talk again. However, it's easier to just purge the > ossec-agent package from each of the servers and reinstall it and let it do > a fresh registration in that case. > > I learned my lesson, though. Ensure I'm on the correct server before doing > dumb things. >
And just as important: Backup, backup, backup! In fact, I've opened up an issue on the docs github to remind myself to document backups better (https://github.com/ossec/ossec-docs/issues/80). > Thanks all. > > > On Tue, Jan 27, 2015 at 2:42 PM, Michael Starks > <[email protected]> wrote: >> >> On 2015-01-27 14:43, Todd Courtnage wrote: >>> >>> To answer my own question, simply adding the contents of client.keys >>> on one of my agents to the the server client.keys file did not work. A >>> different error in the logs on the agent: >>> >>>> 2015/01/27 20:34:51 ossec-agentd: WARN: Duplicate error: global: >>>> 0, local: 90, saved global: 84, saved local:4166 >>>> 2015/01/27 20:34:51 ossec-agentd(1407): ERROR: Duplicated counter >>>> for 'xx.yyyy.com [1]'. >>>> 2015/01/27 20:34:51 ossec-agentd(1214): WARN: Problem receiving >>>> message from ossec.server.com/11.11.11.11 [2]. >> >> >> Delete the rids files, restart the manager and try again. If that doesn't >> work, also delete the rids on the agent and restart that too. >> >> >> -- >> >> --- You received this message because you are subscribed to the Google >> Groups "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/d/optout. > > > > > -- > Todd Courtnage > Director of Cloud Computing > > Chaordix - Crowd Intelligence > > email: [email protected] > office: +1.403.263.2655 > toll free: +1.866.263.7775 > mob: + 1.403.975.1591 > > http://www.chaordix.com > > > Follow us on twitter: http://twitter.com/chaordix > Our blog: http://www.chaordix.com/blog/ > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
