If you see something like the following your /var/ossec/logs/ossec.log file:
ossec.log:2015/08/28 06:49:27 ossec-remoted(1407): ERROR: Duplicated counter for ‘AGENT-NAME'. Then it meant that you are re-using your Agent ID and Key, OSSEC keeps a counter when syncing between Server and Agent, this is to prevent some sort of “Replay” attacks. All you need to do is to remove the file with your AGENT NAME as filename in the the /var/ossec /queue/rids, do this in both Server and Agent installation, restart both server and agent, you are done. Regards, Eric Teng > On Aug 31, 2015, at 8:55 PM, Saulius Pabarska <[email protected]> > wrote: > > I think the problem was because i extented maximum number of agents in > previuos version, and when i did upgrade it stopped work. > I downloaded sources, made > make setmaxagents > and run install > After that it seems everything is working. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] > <mailto:[email protected]>. > For more options, visit https://groups.google.com/d/optout > <https://groups.google.com/d/optout>. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
