Hey! I know it's quite an old thread, but any chance you remember how to fix this? I have an old/important Ossec server with too many Invalid Ids. Any way I can filter the dead clients and remove them?
On Saturday, 8 December 2012 03:49:21 UTC+5:30, Brenden Walker wrote: > > On Fri, 7 Dec 2012 13:57:20 -0800 Stephane Rossan <[email protected] > <javascript:>> wrote: > > Hi all, > > > > I just installed OSSEC 2.7 on linux, and noticed the following error > > messages in ossec.log: > > 2012/12/07 21:51:33 ossec-remoted(1408): ERROR: Invalid ID for the > > source ip: 'x.x.x.x'. > > It is filling up the file quickly, any idea what the issue is? > > Sounds like you have an agent using a key for a different IP address or > the IP address of the client changed. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
