On Mon, Feb 6, 2017 at 1:49 PM, Steve Dimoff <steve.dim...@gmail.com> wrote: > Hey everyone, > > I've been searching through this group and I couldn't find any reference of > someone explaining the difference between global / local and then saved. > > I'm trying to figure out WHY the duplicate error is happening, I know how to > fix it... just trying to understand it more. > > Here is a message: > > ossec-remoted: WARN: Duplicate error: global: 88640, local: 356, saved > global: 88642, saved local:4574 > > > A couple weeks ago I had enabled debug for a short period of time and when > digging around today, I found this: > > ossec-remoted: INFO: Assigning counter for agent xxxxxx: '85808:2777' > > > Is global/local the counts returned from the AGENT for server counts / agent > counts and then saved is what the SERVER has stored for server counts / > agent counts ? > > If this is the case, then local being 356 would show the counts got reset on > the AGENT side, correct? >
I believe this is correct, but I don't know much about how Daniel Cid had this all setup. On the server, I think the highest response from the agent is kept in `/var/ossec/queue/rids/agent_id` and the msg counter for the server is kept in sender_counter. But again, I haven't dug into all that yet. > Thanks for your help! > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
