[ossec-list] Re: Agent got disconnected and can't connect back

2014-05-15 Thread 'Bart Nukats' via ossec-list
Thanks Dan, Seems that removing the queue of rids helped, why did it happen in the first place? what is the possible cause and how to avoid future disconnects? Br. On Wednesday, 14 May 2014 14:47:49 UTC+2, Bart Nukats wrote: Hello, I'm having issues with agents, I'm unable to successfully

Re: [ossec-list] Fluentd and OSSEC

2014-05-15 Thread Phil Daws
Any thoughts on this please ? - Original Message - To: ossec-list@googlegroups.com Sent: Tuesday, 13 May, 2014 7:55:10 AM Subject: [ossec-list] Fluentd and OSSEC Hello, am trying to integrate Fluentd (td-agent) with OSSECs JSON syslog output but having issues with how the message is

Re: [ossec-list] Fluentd and OSSEC

2014-05-15 Thread dan (ddp)
On Tue, May 13, 2014 at 2:55 AM, Phil Daws ux...@splatnix.net wrote: Hello, am trying to integrate Fluentd (td-agent) with OSSECs JSON syslog output but having issues with how the message is emitted. When it arrives in td-agent it looks like: 20140513T011505+0100ips.ossec.reformed

Re: [ossec-list] Re: Agent got disconnected and can't connect back

2014-05-15 Thread dan (ddp)
On Thu, May 15, 2014 at 2:27 AM, 'Bart Nukats' via ossec-list ossec-list@googlegroups.com wrote: Thanks Dan, Seems that removing the queue of rids helped, why did it happen in the first place? what is the possible cause and how to avoid future disconnects? It generally happens when the OSSEC

[ossec-list] Reporting network changes

2014-05-15 Thread Steven Stern
I'm getting network change notifications a couple of times per day on one system. It appears it's comparing the current state to some base state where most of the services weren't started. I can't find anything in the logs to indicate that services are being restarted during the day, so this is a

Re: [ossec-list] Reporting network changes

2014-05-15 Thread dan (ddp)
On Thu, May 15, 2014 at 12:21 PM, Steven Stern subscribed-li...@sterndata.com wrote: I'm getting network change notifications a couple of times per day on one system. It appears it's comparing the current state to some base state where most of the services weren't started. I can't find anything