hello, I have the following scenario:
My agents were all disconnected for no reason, when I restart them with the command /agent_control -R XXXX this throws an error that it is not possible to connect.
do you know what could be causing this error?
the current version of ossec installed is version 3.1
thnk
agent disconnect
Re: agent disconnect
Good morning,
What errors do you see in the ossec.log?
What errors do you see in the ossec.log?
Re: agent disconnect
Good morning,
I do not have permissions to access ossec.log ,but the error on reboot is
"agent_control: ERROR: (1210): Queue '/queue/alerts/ar' not accessible: 'Connection refused'.
Or
agent_control: ERROR: (1301): Unable to connect to active response queue.
Or
** Unable to connect to remoted."
I do not have permissions to access ossec.log ,but the error on reboot is
"agent_control: ERROR: (1210): Queue '/queue/alerts/ar' not accessible: 'Connection refused'.
Or
agent_control: ERROR: (1301): Unable to connect to active response queue.
Or
** Unable to connect to remoted."
-
- Atomicorp Staff - Site Admin
- Posts: 8355
- Joined: Wed Dec 31, 1969 8:00 pm
- Location: earth
- Contact:
Re: agent disconnect
Is remoted running?
Re: agent disconnect
when the agents are down all the services stop running, now that I activated them first I had to activate the service, but the issue is, why are they disconnected for no reason?
-
- Atomicorp Staff - Site Admin
- Posts: 8355
- Joined: Wed Dec 31, 1969 8:00 pm
- Location: earth
- Contact:
Re: agent disconnect
Is there anything in /var/log/messages on the agent about what happened when it stopped running?
Re: agent disconnect
When I check there is always a memory problem message, however, it does not always kill the same service.
sometimes it kills the ossec service but at other times it kills any other service and the agents go down as well.
sometimes it kills the ossec service but at other times it kills any other service and the agents go down as well.
- mikeshinn
- Atomicorp Staff - Site Admin
- Posts: 4149
- Joined: Thu Feb 07, 2008 7:49 pm
- Location: Chantilly, VA
Re: agent disconnect
Whats the specific message your OS generating?
Michael Shinn
Atomicorp - Security For Everyone
Atomicorp - Security For Everyone