Actually it appears to be part of the /opt/ossec/bin/list_agents -n output, but if the agents have been removed from OSSEC scanning why would they still show up.
As stated before they were removed via the /opt/ossec/bin/manage_agents - but still show up in this output. -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of LostInTheTubez Sent: Thursday, July 10, 2014 1:02 PM To: [email protected] Subject: RE: FW: [ossec-list] Production OSSEC Agents are not connected - false Error Do you get the email at the same time every day? Perhaps someone setup a cron job to look at the output of 'agent_control -l' and parse the disconnected agents into an email? > -----Original Message----- > From: [email protected] [mailto:[email protected]] > On Behalf Of Farnsworth, Robert > Sent: Thursday, July 10, 2014 8:55 AM > To: [email protected] > Subject: RE: FW: [ossec-list] Production OSSEC Agents are not > connected - false Error > > No but we do use SNORT. > > -----Original Message----- > From: [email protected] [mailto:[email protected]] > On Behalf Of Michael Starks > Sent: Thursday, July 10, 2014 11:49 AM > To: [email protected] > Subject: RE: FW: [ossec-list] Production OSSEC Agents are not > connected - false Error > > On 2014-07-10 7:38, Farnsworth, Robert wrote: > > Yes it comes from an e-mail alert. I'll check out the client.keys > > > > Thanks, for the reply. > > This must be coming from something other than OSSEC. Do you use the > Atomic version or Alien Vault? > > -- > > --- > You received this message because you are subscribed to the Google > Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send > an email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google > Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send > an email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
