All Apps and Add-ons

Why does OSSEC Agent Status Over Time truncate status

phswartz
New Member

As I continue to troubleshoot the different Ossec for Splunk I come across very odd behavior. Such as in the "Agent Status Over Time" will give me results for:

Act

Activ

Active

Active/Local

Disco

Disconnecte

Disconnected

Never c

Never connect

Never connected

This of course throws off the status numbers and I'm betting is a symptom of a larger issue.
Has anyone seen this before? I have 2 independent/different Ossec/Splunk servers each with 900+ active agents and they both act the same way.

Please, please, please, suggestions/hints/ideas.

I am using OSSEC 2.6, with Splunk version 4.2.3, build 105575, and Splunk for OSSEC 1.1.88 on SuSE Linux 10.3.

Thanks

0 Karma

southeringtonp
Motivator

There's a good chance this is caused by your data collection timing out, and having the field match on partial context in the timeout error message.

For more detail, see the response to your other posted question:

    
http://splunk-base.splunk.com/answers/29021/ossec_agent_statuspy-v-on-local-server-timeout-exceeded-...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...