Hey Everyone, I am noticing some irregular activity in some of my OSSEC agents -
*A little bit about the system - * My Deployment is on 2000~ servers managed from dedicated ossec manager. I currently have 1600~ agents connected on a full basis and 400~ servers who connect and disconnect all the time. All the ports are opened (confirmation with NC and telnet) On my management server I see the following error in the logs - 2016/07/20 05:33:49 ossec-remoted(1407): ERROR: Duplicated counter for '**************'. 2016/07/20 05:33:55 ossec-remoted: WARN: Duplicate error: global: I checked the /var/ossec/queue/rids and made sure there is only a single entry in there and that entry is the same on both host and Management. I made a double check and also compared client.keys on both servers,Same Key and same Entry on both servers. I did a key exchange manually between both servers just to make sure Nothing was wrong in that section. Same error. Does anyone have an idea on how to continue? -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
