Page 1 of 1

agent disconnect

Posted: Wed Sep 01, 2021 1:11 pm
by javirosoc
hello, I have the following scenario:
My agents were all disconnected for no reason, when I restart them with the command /agent_control -R XXXX this throws an error that it is not possible to connect.
do you know what could be causing this error?
the current version of ossec installed is version 3.1

thnk

Re: agent disconnect

Posted: Thu Sep 02, 2021 8:02 am
by cponton
Good morning,

What errors do you see in the ossec.log?

Re: agent disconnect

Posted: Thu Sep 02, 2021 10:06 am
by javirosoc
Good morning,
I do not have permissions to access ossec.log ,but the error on reboot is

"agent_control: ERROR: (1210): Queue '/queue/alerts/ar' not accessible: 'Connection refused'.

Or
agent_control: ERROR: (1301): Unable to connect to active response queue.

Or

** Unable to connect to remoted."

Re: agent disconnect

Posted: Fri Sep 03, 2021 4:42 pm
by scott
Is remoted running?

Re: agent disconnect

Posted: Mon Sep 06, 2021 3:41 pm
by javirosoc
when the agents are down all the services stop running, now that I activated them first I had to activate the service, but the issue is, why are they disconnected for no reason?

Re: agent disconnect

Posted: Mon Sep 13, 2021 9:30 am
by scott
Is there anything in /var/log/messages on the agent about what happened when it stopped running?

Re: agent disconnect

Posted: Fri Sep 24, 2021 8:15 am
by javirosoc
When I check there is always a memory problem message, however, it does not always kill the same service.
sometimes it kills the ossec service but at other times it kills any other service and the agents go down as well.

Re: agent disconnect

Posted: Tue Sep 28, 2021 1:12 pm
by mikeshinn
Whats the specific message your OS generating?