OSSEC agents this morning were working without issue and then began reporting as Disconnected. Agent logs are returning the following error:
2017/03/27 10:14:38 ossec-agent: WARN: Process locked. Waiting for permission... 2017/03/27 10:14:49 ossec-agent(4101): WARN: Waiting for server reply (not started). Tried: '. 2017/03/27 10:14:51 ossec-agent: INFO: Trying to connect to server (:1514). Nothing has changed on the server to the best of our knowledge. One anomaly we are seeing that may be related is the following when restarting Wazuh manager services: *Deleting PID file '/var/ossec/var/run/ossec-remoted-4816.pid' not used...* Killing ossec-monitord .. Killing ossec-logcollector .. ossec-remoted not running .. Killing ossec-syscheckd .. Killing ossec-analysisd .. Killing ossec-maild .. Killing ossec-execd .. Killing wazuh-modulesd .. Wazuh v2.0 Stopped Starting Wazuh v2.0 (maintained by Wazuh Inc.)... Started wazuh-modulesd... Started ossec-maild... Started ossec-execd... Started ossec-analysisd... Started ossec-logcollector... Started ossec-remoted... Started ossec-syscheckd... Started ossec-monitord... Completed. /var/ossec/bin/ossec-analysisd -V Wazuh v2.0 - Wazuh Inc. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License (version 2) as published by the Free Software Foundation. For more details, go to http://www.ossec.net/main/license/ /etc/ossec-init.conf DIRECTORY="/var/ossec" NAME="Wazuh" VERSION="v2.0" DATE="Wed Mar 15 11:38:44 UTC 2017" TYPE="server" Any suggestions would be greatly appreciated. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
