We'll deploy that, tahnks for your help! On Tuesday, November 1, 2016 at 6:38:56 AM UTC-4, dan (ddpbsd) wrote: > > On Thu, Oct 27, 2016 at 10:10 AM, Gaetan Noel <[email protected] > <javascript:>> wrote: > > I'll give a try to disable the counter and see how it goes. Is it this > > setting in internal_options ? > > > > remoted.verify_msg_id=0 > > > # Remoted counter io flush. > > remoted.recv_counter_flush=128 > > > > Should I set it to 0 ? > > > > Thanks > > > > On Wednesday, October 26, 2016 at 2:06:06 PM UTC-4, Gaetan Noel wrote: > >> > >> Hello, > >> > >> We are having an issue that makes me want to pull my hair out. > >> > >> Since about two days we get what seems to be a random number of agents > >> that become disconnected. On that particular environment we have a > total of > >> about 1200+ keys. Everything was working well, most clients were online > and > >> reporting correctly to the server. > >> > >> About two days ago we noticed that a very large number of agents became > >> Disconnected leaving about 200 clients Active. The issue is on and off > as > >> sometime we see 300 agents active other times 40. > >> > >> On the client side we see the errors below : > >> > >> 2016/10/26 11:55:45 ossec-agentd: WARN: Duplicate error: global: 2, > >> local: 9796, saved global: 3789, saved local:7032 > >> 2016/10/26 11:55:45 ossec-agentd(1407): ERROR: Duplicated counter for > >> 'XXX'. > >> 2016/10/26 11:55:45 ossec-agentd(1214): WARN: Problem receiving message > >> from x.x.x.x. > >> 2016/10/26 11:55:45 ossec-agentd(4101): WARN: Waiting for server reply > >> (not started). Tried: x.x.x.x. > >> > >> The duplicated error is something we've been seeing there and there > since > >> the start (about 3 years ago) and everything was working well. > >> > >> Now if I check a client that is Active now we see the errors above when > he > >> was Disconnected and now we don't see them. However nothing has changed > on > >> the server. > >> > >> It's like if it can only accept a number x of clients. > >> OSSEC has been installed with "2048" for maxagents and ulimits has been > >> setup accordingly. > >> > >> Do you have any ideas of where I can look ? > >> (Please don't tell me to recreate the keys as the problem obviously > comes > >> from the server :-)) > >> > >> Thanks > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/d/optout. >
-- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
