On Feb 13, 2017 11:48 AM, "aiborin" <abo...@transunion.com> wrote:
I am running an OSSEC server in each of my two data centers. In one data center, the server will stop the ossec-remoted service multiple times a week. There is nothing in /var/ossec/logs/ossec.log to indicate why. I get the following output when running /var/ossec/bin/ossec-control status: ossec-remoted: Process XXXXX not used by ossec, removing .. ossec-remoted not running… This situation, of course, results in loss of communication with all agents. I can mitigate the impact by running a cron job that restarts ossec-remoted but this only masks the underlying problem. I have searched Google but have not found a way in which to isolate the source of this problem and am hoping someone monitoring the list can provide a possible solution. What version of ossec? What's your remote config? Try running itin debug/foreground to see if it provides more info `/var/ossec/bin/ossec-remoted -df` Regards, -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
