Ok, thanks Pedro. I have changed the role to use 'manage_agents -r' and to
restart the ossec server. Much nicer.
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an
Hi Barry,
You can run manage_agents with option "-r" and it will remove an agent, so
you can create some scripts to automatize the process.
/var/ossec/bin/manage_agents -r AGENTID
OSSEC has internally a hash table with client.keys table, removing manually
from client.keys or using
Thanks! Of course it would be much nicer manage_agents was a little nicer
to automation...
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to
Short answer yes, deleting it from client.keys is enough.
On the other hand, although it is not necessary, there are also some
residual files you might want to delete as well. Those are in
/var/ossec/queue/rids (message counters), /var/ossec/queue/syscheck (fim
database),
Can I remove a registered agent by simply deleting the line in client.keys?
That is, skipping the manage_agents program?
I am just adding the last few edge cases to our ansible provisioning of
ossec. My current edge case is when an
instance has been destroyed and rebuilt. In this case the name
