Hello, I have a Server/Agent configuration with active response enabled. In this scenario, there is an active response with the option <location>all</location>. The set-up works as expected and the active response is triggered in all the agents when the alert is generated. However, if the server is restarted (because of a node shut-down for example), the active response stops working on the agents. If agents are restarted, then active response starts working again. Is this the expected behavior? Is there a way to handle the case of a server restart or stop/start? In other words. is there are a way for agents to realize that the server was restarted and thus they should restart the agent processes again?
Thank you, Bruno -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
