All Apps and Add-ons

Why does OSSEC Agent Status Over Time truncate status

phswartz
New Member

As I continue to troubleshoot the different Ossec for Splunk I come across very odd behavior. Such as in the "Agent Status Over Time" will give me results for:

Act

Activ

Active

Active/Local

Disco

Disconnecte

Disconnected

Never c

Never connect

Never connected

This of course throws off the status numbers and I'm betting is a symptom of a larger issue.
Has anyone seen this before? I have 2 independent/different Ossec/Splunk servers each with 900+ active agents and they both act the same way.

Please, please, please, suggestions/hints/ideas.

I am using OSSEC 2.6, with Splunk version 4.2.3, build 105575, and Splunk for OSSEC 1.1.88 on SuSE Linux 10.3.

Thanks

0 Karma

southeringtonp
Motivator

There's a good chance this is caused by your data collection timing out, and having the field match on partial context in the timeout error message.

For more detail, see the response to your other posted question:

    
http://splunk-base.splunk.com/answers/29021/ossec_agent_statuspy-v-on-local-server-timeout-exceeded-...

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!