Agents Disconnecting- Error Waiting Mutex (Timeout).

Support/Development for OSSEC
RL8Support
New Forum User
New Forum User
Posts: 2
Joined: Thu Nov 03, 2022 10:05 am

Agents Disconnecting- Error Waiting Mutex (Timeout).

Unread post by RL8Support »

Hello,

Environment info: OSSEC Server installed on Rocky Linux 8 minimal, agents are on Windows Server 2022 and Rocky Linux 8 servers. Agent & server are v3.7.0

I've run into an issue with our OSSEC-HIDS installation. We have two different networks, each with their own install of OSSEC. One is working fine, no issues. The second all of the agents are disconnecting at night. I check the logs the next day and see multiple 'ossec-agent: Error waiting mutex (timeout). Restarting the OSSEC-HIDS process lets the agents reconnect but this isn't a viable solution each day. We need to have the agents online at all times. Any help is appreciated.

Thank you.
User avatar
cponton
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 61
Joined: Fri Oct 09, 2020 9:41 am

Re: Agents Disconnecting- Error Waiting Mutex (Timeout).

Unread post by cponton »

It could mean that the OS is restricting processes through systemd, or possibly selinux. Or maybe 2 instances of the agent are running at the same time?

A good place to start would be to stop the agent, and see if any processes are still running.
RL8Support
New Forum User
New Forum User
Posts: 2
Joined: Thu Nov 03, 2022 10:05 am

Re: Agents Disconnecting- Error Waiting Mutex (Timeout).

Unread post by RL8Support »

Hi cponton,

Would that be the case for all Agents disconencting at the same time? The agents are disconnecting sometime in the night and they all have the same error message. Are there specific allowances for SELinux for OSSEC?

Thank you
Post Reply