I think this message just means that the agent has not exchanged data with the manager during those 10 minutes, and it is just sending a keepalive message to let it know that it is running. Just informational and nothing to be worried about.
Regarding agents not connecting back after a restart, that is a totally different thing. Usually it could take a few minutes to get them back, this can be specified in agent config with time-reconnect variable (by default 180secs I think) Best regards On Thu, Apr 28, 2016 at 8:15 AM, Viktor Buchkivskyi < [email protected]> wrote: > Hi guys, > > i've encountered the same issue with windows agents with ossec v2.8.3 > (server and clients) > linux lients - not affected > windows clients - thowing this message "ossec-agent: More than 600 > seconds without server response...sending win32info" every 10 min > > it looks like that after ossec-hids server has been restarted - windows > clients are no longer able to connect to server > > > On Monday, August 11, 2014 at 5:03:44 AM UTC+3, Ameya Bhatkal wrote: >> >> Hi Everyone, >> >> I am running Ossec HIDS 2.8 on Server mode on Ubuntu 14.04 >> >> I have installed around 5-6 Ossec client agents with active response >> disabled on windows 7 machines. >> >> My problem is that my ossec.log file which is present in the Ossec client >> machine is filled with the following error messages: >> >> "Ossec-agent: More than 600 seconds without server response...sending >> win32info" >> >> There is no firewall present between the Server and the agents. Every 3rd >> or 4th line of the ossec.log file contains the above error. >> >> Could anyone help me out with this issue? >> > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
