When i change verify_msg_id=0; *i have lots of error in ossec log*
2016/05/13 14:33:17 ossec-agent: ERROR: Could not move (tmp/Security-a06404) to (bookmarks/Security) which returned (5) 2016/05/13 14:33:17 ossec-agent: ERROR: Could not rename_ex() temporary bookmark (tmp/Security-a06404) to (bookmarks/Security) for (Security) 2016/05/13 14:33:17 ossec-agent: ERROR: Could not move (tmp/Security-a06404) to (bookmarks/Security) which returned (5) 2016/05/13 14:33:17 ossec-agent: ERROR: Could not rename_ex() temporary bookmark (tmp/Security-a06404) to (bookmarks/Security) for (Security) 2016/05/13 14:33:17 ossec-agent: ERROR: Could not move (tmp/Security-a06404) to (bookmarks/Security) which returned (5) 2016/05/13 14:33:17 ossec-agent: ERROR: Could not rename_ex() temporary bookmark (tmp/Security-a06404) to (bookmarks/Security) for (Security) 12 Mayıs 2016 Perşembe 10:37:15 UTC+3 tarihinde Pedro S yazdı: > > Hi, > > If multiple agents are using the same key, you need to set them up with > their own unique key. > If you re-installed an agent and didn't backup the rids files, you should > create a new key for the agent and use that. > If you prefer to avoid any counters error, try to deactivate counters, > open file etc/internal_options.conf (Manager & Agent) and set > verify_msg_id=0. > > > Regards, > > > Pedro S. > > On Wednesday, May 11, 2016 at 10:33:00 PM UTC+2, Abdulvehhab Agin wrote: >> >> Hi, >> >> >> >> Sometimes ossec server says *"ERROR: Duplicated counter for"* errors. >> Especially we have mass log, and log sending protocol is UDP, so rids >> counter' agent and server sometimes inconsistent; >> >> >> When i see this error, I see the agent is inactive. After this; agent >> wont send any logs. >> >> >> How can i solve this problem? >> >> >> OSSEC version 2.8.3 >> >> -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
