Atomicorp

Hello,

Environment info: OSSEC Server installed on Rocky Linux 8 minimal, agents are on Windows Server 2022 and Rocky Linux 8 servers. Agent & server are v3.7.0

I've run into an issue with our OSSEC-HIDS installation. We have two different networks, each with their own install of OSSEC. One is working fine, no issues. The second all of the agents are disconnecting at night. I check the logs the next day and see multiple 'ossec-agent: Error waiting mutex (timeout). Restarting the OSSEC-HIDS process lets the agents reconnect but this isn't a viable solution each day. We need to have the agents online at all times. Any help is appreciated.

Thank you.

It could mean that the OS is restricting processes through systemd, or possibly selinux. Or maybe 2 instances of the agent are running at the same time?

A good place to start would be to stop the agent, and see if any processes are still running.

Hi cponton,

Would that be the case for all Agents disconencting at the same time? The agents are disconnecting sometime in the night and they all have the same error message. Are there specific allowances for SELinux for OSSEC?

Thank you