On Fri, Apr 19, 2013 at 10:49 AM, Michiel van Es <vanesmich...@gmail.com> wrote: > > > Op vrijdag 19 april 2013 16:47:34 UTC+2 schreef dan (ddpbsd) het volgende: >> >> On Thu, Apr 18, 2013 at 7:27 AM, Michiel van Es <vanesm...@gmail.com> >> wrote: >> > >> > >> > Op woensdag 17 april 2013 17:53:47 UTC+2 schreef dan (ddpbsd) het >> > volgende: >> >> Is the file recreated? What is in that file? >> > >> > >> > yes it is recreated with the following contents: >> > >> > server001 >> > - >> > 1371 >> > (null) >> > >> > The ID and servername matches >> >> What are the permissions for this file? This is where the problem is. >> You'll have to find out why this file isn't getting populated. > > > Well its even more bizarre after some tests: most of the windows machine are > doing fine except for this one specific server/agent. > All other 2003/2008 servers are doing fine and are connected. > So we suspect something with this server that is blocking it or that breaks > it. >
How many agents do you have connecting to this OSSEC server? I'm guessing that tracing the appropriate server process might be one of the easier ways to find the answer. > Michiel > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
