Splunk Search

Agent list in OSSEC agent status dashboard is empty

janfabo
Explorer

Hello. Yesterday I installed OSSEC & Splunk on server, and everything is working great, except two small things: OSSEC agent status shows No results found, although on ossec's agent_control -l I can see 12 agents, which are currently reporting. OSSEC agent coverage shows two agents: zeus and 10.10.10.10. How can I see them in this dashboard?
And 2nd thing is a bit trait: IP address of zeus is 10.10.10.10, how to cancel one of them?
Thanx for advice.

Tags (4)
0 Karma

southeringtonp
Motivator

If you can't see the agents, make sure that the agent management inputs scripts are working correctly. The most common issue is that either agent polling hasn't been configured or that it is seeing a password prompt and aborting.

First, make sure that you have configured the agent polling commands in ossec_servers.conf.

Then run the following and looking for errors:

cd /opt/splunk/etc/apps/ossec/bin
./ossec_agent_status.py
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...