[ossec-list] Re: agent won't connect (but it used to)

2011-04-26 Thread Kat
found the problem - indeed it was the firewall. It was blocked off. But since the connections are stateful and had been established, they hung on until I restarted the agents. As each agent was restarted, the firewall block for the return acknowledgment was blocked and thus the problem of the missi

[ossec-list] Re: agent won't connect (but it used to)

2011-04-26 Thread Kat
Actually I was wrong - it was NOT being blocked - but it exhibited what looked like blocking -- it was the IP tuning params and max clients causing a backup of the queue and the server, which was not overloaded, could not clear the queue fast enough. Increased max agents to 2048 and bumped several

Re: [ossec-list] Re: agent won't connect (but it used to)

2011-04-26 Thread dan (ddp)
For the archives: How many agents did you have on that server? Which "IP tuning params" did you bump? On Tue, Apr 26, 2011 at 11:49 AM, Kat wrote: > Actually I was wrong - it was NOT being blocked - but it exhibited > what looked like blocking -- it was the IP tuning params and max > clients caus