Search found 6 matches

by javirosoc
Thu Nov 18, 2021 3:35 pm
Forum: OSSEC
Topic: ossec-syscheckd ERROR 1756
Replies: 1
Views: 40337

ossec-syscheckd ERROR 1756

Hello,
When I enter the keys of an agent and then start it, I get the error
ossec-syscheked ERROR: (1756): Duplicated directory

in the agent the service is up, however, in the ossec server it shows as "never connected".

please help
by javirosoc
Wed Oct 20, 2021 12:40 pm
Forum: OSSEC
Topic: agent disconnect
Replies: 1
Views: 39016

agent disconnect

Hi!
I have the following situation:
In the ossec there are 7 out of 30 agents that appear as "disconnected", however, when I check the status of the agents with the command /var/ossec/bin/agent-control satus these appear with the service running.
by javirosoc
Fri Sep 24, 2021 8:15 am
Forum: OSSEC
Topic: agent disconnect
Replies: 7
Views: 58514

Re: agent disconnect

When I check there is always a memory problem message, however, it does not always kill the same service.
sometimes it kills the ossec service but at other times it kills any other service and the agents go down as well.
by javirosoc
Mon Sep 06, 2021 3:41 pm
Forum: OSSEC
Topic: agent disconnect
Replies: 7
Views: 58514

Re: agent disconnect

when the agents are down all the services stop running, now that I activated them first I had to activate the service, but the issue is, why are they disconnected for no reason?
by javirosoc
Thu Sep 02, 2021 10:06 am
Forum: OSSEC
Topic: agent disconnect
Replies: 7
Views: 58514

Re: agent disconnect

Good morning, I do not have permissions to access ossec.log ,but the error on reboot is "agent_control: ERROR: (1210): Queue '/queue/alerts/ar' not accessible: 'Connection refused'. Or agent_control: ERROR: (1301): Unable to connect to active response queue. Or ** Unable to connect to remoted.&...
by javirosoc
Wed Sep 01, 2021 1:11 pm
Forum: OSSEC
Topic: agent disconnect
Replies: 7
Views: 58514

agent disconnect

hello, I have the following scenario: My agents were all disconnected for no reason, when I restart them with the command /agent_control -R XXXX this throws an error that it is not possible to connect. do you know what could be causing this error? the current version of ossec installed is version 3....