Short answer yes, deleting it from client.keys is enough. On the other hand, although it is not necessary, there are also some residual files you might want to delete as well. Those are in /var/ossec/queue/rids (message counters), /var/ossec/queue/syscheck (fim database), /var/ossec/queue/rootcheck (rootchecks database) and /var/ossec/queue/agent-info. Look for the files specific to your agent, do not delete everything in those directories.
Best On Sun, Feb 21, 2016 at 6:59 AM, Barry Kaplan <[email protected]> wrote: > Can I remove a registered agent by simply deleting the line in > client.keys? That is, skipping the manage_agents program? > > I am just adding the last few edge cases to our ansible provisioning of > ossec. My current edge case is when an > instance has been destroyed and rebuilt. In this case the name would be > the same but the IP address will > almost certainly be different (this is on AWS). > > It would be way way easier to remove the line from client.keys that figure > out to automate manage_agents. > It seems that the environment variable mechanism does not support removing > agents. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
