Do you get the email at the same time every day? Perhaps someone setup a cron job to look at the output of 'agent_control -l' and parse the disconnected agents into an email?
> -----Original Message----- > From: [email protected] [mailto:[email protected]] On > Behalf Of Farnsworth, Robert > Sent: Thursday, July 10, 2014 8:55 AM > To: [email protected] > Subject: RE: FW: [ossec-list] Production OSSEC Agents are not connected - > false > Error > > No but we do use SNORT. > > -----Original Message----- > From: [email protected] [mailto:[email protected]] On > Behalf Of Michael Starks > Sent: Thursday, July 10, 2014 11:49 AM > To: [email protected] > Subject: RE: FW: [ossec-list] Production OSSEC Agents are not connected - > false > Error > > On 2014-07-10 7:38, Farnsworth, Robert wrote: > > Yes it comes from an e-mail alert. I'll check out the client.keys > > > > Thanks, for the reply. > > This must be coming from something other than OSSEC. Do you use the Atomic > version or Alien Vault? > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
