Thanks for clarifying this. After i synced agent-info, the last keep alive messages were the same on all hosts.
Am Montag, 10. August 2015 17:46:54 UTC+2 schrieb dan (ddpbsd): > > On Wed, Aug 5, 2015 at 3:44 AM, horst knete <[email protected] > <javascript:>> wrote: > > Hi, > > > > i wanted to ask quickly where the (I mean in term of ossec folder path) > the > > information of the last keep alive of the agents is stored. > > > > background: > > > > i set up an ossec failover cluster with shared network volumes (i. e. > > /var/ossec/queue/rootcheck , /var/ossec/queue/syscheck). Everything is > > working fine, the agents can connect to ether of the ossec servers, but > what > > makes me wonder is, that the agents status on some of them is shown als > > disconnected, although the agent is connect ot an other ossec sever at > the > > time. It seems that i didn´t shared the folder that contains this > > information. > > > > I think it's /var/ossec/queue/agent-info (rids is also important). > > > > > Thanks for response > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
