Hey Brent, I'm running 2.9.3. I actually just fixed it. Right after I posted this I realized that the ossec user was probably running out of open file handlers. I bumped the hard and soft limits up in /etc/security/limits.conf and rebooted the master server, and we're back up and running.
On Thursday, May 3, 2018 at 12:16:00 PM UTC-6, Brent Morris wrote: > > What version of OSSEC are you running? Also, can you check your > /var/ossec/logs/ossec.log to see if it's unable to listen on port 1514? > You can run ossec-remoted from command line with -f and/or -d to get more > details. > > On Thursday, May 3, 2018 at 11:01:55 AM UTC-7, Cooper wrote: >> >> Hey all (Dan), >> >> I pushed out the new version of the ossec agent to about 1,000 servers >> last night. However, remoted on port 1514 crashes on start, without >> logging an error message as to why. Is there something that I need to >> tweak for this many agents? It was working just fine with the trial run of >> ~300. >> >> Thanks! >> > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
