On Fri, Aug 28, 2015 at 11:15 AM, Doman, Tyler <tyler.do...@hp.com> wrote: > Hi, > > > > I’ve been running OSSEC for a couple of years now without any significant > issues. The server monitors around 200 servers that is a mix of Windows and > Unix servers. Recently, OSSEC is alerting me that most, if not all, agents > are repeatedly disconnecting and reconnecting. There is no pattern that I’ve > been able to notice. The disconnects span anywhere from 2 hours to 7 hours. > I suspect there is an issue with OSSEC server. Has anyone encountered this > and have suggestions on what I should do? If there’s logs on the server that > I can check, please direct me to where those are and what I should look for > in the logs. >
/var/ossec/logs/ossec.log If you don't see anything, try turning debugging on with `/var/ossec/bin/ossec-control enable debug` and restart the ossec processes. > > > Regards, > > > > Tyler Doman, CISSP, CHP > > Account Security Officer > > Enterprise Security Services > > Hewlett Packard > > +1 541.360.4028/ Office > > +1 503.383.8411/ Mobile > > tyler.do...@hp.com > > 4070 27th CT SE, Suite 100, Salem, OR 97302 > > > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
