On Tue, Apr 5, 2016 at 11:01 AM, sandeep ganti <[email protected]> wrote: > Hello, > > I do have like 6k servers in my environment connected to one of the OSSEC > Server/manager. Out of the 6k only approx 3k are showing up as active and > the rest they are shown as disconnected. I decided to kill the OSSEC Process > on the Server/manager and perform a restart so that upon the restart i could > see all the 6k to be active but to my surprise even after stopping the OSSEC > process on the server/manager those 3k servers still show as Active. > > I believe there is something wrong on the Server/manager. Can someone please > suggest me on this ? I have waited for like 15-30 mins for those 3k agents > to show as disconnected and then to restart the OSSEC process on the server > but they still remain as Active even after the OSSEC process is stopped on > the Server. >
If the manager's ossec processes aren't running, how is it going to update the status? I'm not sure where the info is cached (or how you're checking the status), but it's probably old data. > Thanks, > Sandeep. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
