All Apps and Add-ons

Why does OSSEC Agent Status Over Time truncate status

phswartz
New Member

As I continue to troubleshoot the different Ossec for Splunk I come across very odd behavior. Such as in the "Agent Status Over Time" will give me results for:

Act

Activ

Active

Active/Local

Disco

Disconnecte

Disconnected

Never c

Never connect

Never connected

This of course throws off the status numbers and I'm betting is a symptom of a larger issue.
Has anyone seen this before? I have 2 independent/different Ossec/Splunk servers each with 900+ active agents and they both act the same way.

Please, please, please, suggestions/hints/ideas.

I am using OSSEC 2.6, with Splunk version 4.2.3, build 105575, and Splunk for OSSEC 1.1.88 on SuSE Linux 10.3.

Thanks

0 Karma

southeringtonp
Motivator

There's a good chance this is caused by your data collection timing out, and having the field match on partial context in the timeout error message.

For more detail, see the response to your other posted question:

    
http://splunk-base.splunk.com/answers/29021/ossec_agent_statuspy-v-on-local-server-timeout-exceeded-...

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!