Daniel Cid wrote: > -On every agent: > -- stop ossec > -- go to: /var/ossec/queue/rids (or ossec-agent/rids on Windows) and > remove every file in there. > > -Go to the server: > -- Stop ossec > -- Remove the every file under rids too. > > --Restart the server and the agents.
Well, I spoke a bit too soon. But maybe this is by design. One agent will not stay connected, and I get the 'Duplicated counter' messages even after deleting all the rids files on the client and server. This agent has *not* been updated to the latest version. I'm testing backwards compatibility. Should the 0.9-3 version be compatible with the latest beta? Is backwards compatibility a design goal? If I have 50 agents to update, I would want to make sure that I could update the server then have time to update the agents, but not lose the HIDs functionality.
