You are bang on the money, it is UAC. I noticed I had to run the install as administrator I just didn't think I would need to do this every time I ran the Agent Manager. Thanks!
On Tuesday, May 21, 2013 6:35:21 PM UTC+1, Clarky wrote: > I have recently installed OSSEC HIDS server 2.7 along with WebUI 0.3 on > Ubuntu 12.04.2 LTS 64-bit and everything appears to be working OK on the > server side. Today, I installed the OSSEC Windows Agent 2.7 on my Windows > 7 32-bit PC, I followed the normal instructions of adding my PC as agent on > the server first then retrieving the key and entering the server IP and key > into the OSSEC Agent Manager. On first connect everything appears fine and > the OSSEC Agent Manager log confirms that there is a connection to the > server (i.e. I see entries for "INFO: Trying to connect to server" and > "INFO: Connected to the server"). However, I soon as I close the OSSEC > Agent Manager and then re-open it, I get the following issues: > > 1. The OSSEC Agent Manager no longer recognises that the OSSEC Agent > (Windows Service) is running when the service is definitely still running. > 2. The security on the OSSEC Agent Manager log file changes to > Administrators only and I have to add myself to the security of the > file before I can view the file again. > 3. When I click on Start OSSEC through Agent Manager it states unable to > start OSSEC (check config). > 4. I have also found that the agent_control lc command reports that an > agent is active regardless of whether the agent service on the client PC > isn't running which isn't helpful. > > What is going on here? > > Why is the Agent Manager no longer recognising that the service is still > running after the Agent Manager has been restarted? > Surely its not necessary to keep the Agent Manager window open in order > for the service to function properly, there is no way to minimise it to the > tray that I can see. > > I have replicated this issue on 2 different PCs. > > Any help would be really appreciated. > > > > > > > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
