Page 1 of 1
agent disconnect
Posted: Wed Sep 01, 2021 1:11 pm
by javirosoc
hello, I have the following scenario:
My agents were all disconnected for no reason, when I restart them with the command /agent_control -R XXXX this throws an error that it is not possible to connect.
do you know what could be causing this error?
the current version of ossec installed is version 3.1
thnk
Re: agent disconnect
Posted: Thu Sep 02, 2021 8:02 am
by cponton
Good morning,
What errors do you see in the ossec.log?
Re: agent disconnect
Posted: Thu Sep 02, 2021 10:06 am
by javirosoc
Good morning,
I do not have permissions to access ossec.log ,but the error on reboot is
"agent_control: ERROR: (1210): Queue '/queue/alerts/ar' not accessible: 'Connection refused'.
Or
agent_control: ERROR: (1301): Unable to connect to active response queue.
Or
** Unable to connect to remoted."
Re: agent disconnect
Posted: Fri Sep 03, 2021 4:42 pm
by scott
Is remoted running?
Re: agent disconnect
Posted: Mon Sep 06, 2021 3:41 pm
by javirosoc
when the agents are down all the services stop running, now that I activated them first I had to activate the service, but the issue is, why are they disconnected for no reason?
Re: agent disconnect
Posted: Mon Sep 13, 2021 9:30 am
by scott
Is there anything in /var/log/messages on the agent about what happened when it stopped running?
Re: agent disconnect
Posted: Fri Sep 24, 2021 8:15 am
by javirosoc
When I check there is always a memory problem message, however, it does not always kill the same service.
sometimes it kills the ossec service but at other times it kills any other service and the agents go down as well.
Re: agent disconnect
Posted: Tue Sep 28, 2021 1:12 pm
by mikeshinn
Whats the specific message your OS generating?