Hi Everyone, We have a large deployment of OSSEC and use agent-auth to auto deploy agents. At times, there are some old entries for the same agent(Disconnected state) and although we try our best to clear those out before a re-deployment, some get left behind.
Due to this, the agent re-connects with a '2' appended to the hostname, for this new entry. Agent is reporting correctly and in "Active" state, just that the hostname is not accurate. Is there a way I can manually edit the agent name on server side without the need to remove / re-install? I tried editing agent files under /var/ossec/queue/agent-info and /var/ossec/queue/diff, but it didn't make any difference. In fact, after OSSEC restart, the files with incorrect hostnames are back. Looks like I am not making changes at the correct location(assuming it's possible to make such change.. :) ) Any suggestions would be appreciated.. Many Thanks, ~Abhi -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
