On Thu, Jul 10, 2014 at 2:49 PM, Farnsworth, Robert <[email protected]> wrote: > Actually it appears to be part of the /opt/ossec/bin/list_agents -n output, > but if the agents have been removed from OSSEC scanning why would they still > show up. > > As stated before they were removed via the /opt/ossec/bin/manage_agents - > but still show up in this output. >
Did I answer this in another thread? I didn't sleep much last night, so I really don't remember. O_o I think there might be a stale file in /var/ossec/queue/agent-info. > -----Original Message----- > From: [email protected] [mailto:[email protected]] On > Behalf Of LostInTheTubez > Sent: Thursday, July 10, 2014 1:02 PM > To: [email protected] > Subject: RE: FW: [ossec-list] Production OSSEC Agents are not connected - > false Error > > Do you get the email at the same time every day? Perhaps someone setup a cron > job to look at the output of 'agent_control -l' and parse the disconnected > agents into an email? > >> -----Original Message----- >> From: [email protected] [mailto:[email protected]] >> On Behalf Of Farnsworth, Robert >> Sent: Thursday, July 10, 2014 8:55 AM >> To: [email protected] >> Subject: RE: FW: [ossec-list] Production OSSEC Agents are not >> connected - false Error >> >> No but we do use SNORT. >> >> -----Original Message----- >> From: [email protected] [mailto:[email protected]] >> On Behalf Of Michael Starks >> Sent: Thursday, July 10, 2014 11:49 AM >> To: [email protected] >> Subject: RE: FW: [ossec-list] Production OSSEC Agents are not >> connected - false Error >> >> On 2014-07-10 7:38, Farnsworth, Robert wrote: >> > Yes it comes from an e-mail alert. I'll check out the client.keys >> > >> > Thanks, for the reply. >> >> This must be coming from something other than OSSEC. Do you use the >> Atomic version or Alien Vault? >> >> -- >> >> --- >> You received this message because you are subscribed to the Google >> Groups "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send >> an email to [email protected]. >> For more options, visit https://groups.google.com/d/optout. >> >> -- >> >> --- >> You received this message because you are subscribed to the Google >> Groups "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send >> an email to [email protected]. >> For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
