agent disconnect

Support/Development for OSSEC
javirosoc
Forum User
Forum User
Posts: 6
Joined: Wed Sep 01, 2021 1:06 pm

agent disconnect

Unread post by javirosoc »

hello, I have the following scenario:
My agents were all disconnected for no reason, when I restart them with the command /agent_control -R XXXX this throws an error that it is not possible to connect.
do you know what could be causing this error?
the current version of ossec installed is version 3.1

thnk
User avatar
cponton
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 61
Joined: Fri Oct 09, 2020 9:41 am

Re: agent disconnect

Unread post by cponton »

Good morning,

What errors do you see in the ossec.log?
javirosoc
Forum User
Forum User
Posts: 6
Joined: Wed Sep 01, 2021 1:06 pm

Re: agent disconnect

Unread post by javirosoc »

Good morning,
I do not have permissions to access ossec.log ,but the error on reboot is

"agent_control: ERROR: (1210): Queue '/queue/alerts/ar' not accessible: 'Connection refused'.

Or
agent_control: ERROR: (1301): Unable to connect to active response queue.

Or

** Unable to connect to remoted."
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Re: agent disconnect

Unread post by scott »

Is remoted running?
javirosoc
Forum User
Forum User
Posts: 6
Joined: Wed Sep 01, 2021 1:06 pm

Re: agent disconnect

Unread post by javirosoc »

when the agents are down all the services stop running, now that I activated them first I had to activate the service, but the issue is, why are they disconnected for no reason?
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Re: agent disconnect

Unread post by scott »

Is there anything in /var/log/messages on the agent about what happened when it stopped running?
javirosoc
Forum User
Forum User
Posts: 6
Joined: Wed Sep 01, 2021 1:06 pm

Re: agent disconnect

Unread post by javirosoc »

When I check there is always a memory problem message, however, it does not always kill the same service.
sometimes it kills the ossec service but at other times it kills any other service and the agents go down as well.
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: agent disconnect

Unread post by mikeshinn »

Whats the specific message your OS generating?
Post Reply