Hi, If multiple agents are using the same key, you need to set them up with their own unique key. If you re-installed an agent and didn't backup the rids files, you should create a new key for the agent and use that. If you prefer to avoid any counters error, try to deactivate counters, open file etc/internal_options.conf (Manager & Agent) and set verify_msg_id=0.
Regards, Pedro S. On Wednesday, May 11, 2016 at 10:33:00 PM UTC+2, Abdulvehhab Agin wrote: > > Hi, > > > > Sometimes ossec server says *"ERROR: Duplicated counter for"* errors. > Especially we have mass log, and log sending protocol is UDP, so rids > counter' agent and server sometimes inconsistent; > > > When i see this error, I see the agent is inactive. After this; agent wont > send any logs. > > > How can i solve this problem? > > > OSSEC version 2.8.3 > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
