I've setup ossec architecture for my client. Most of the agents that were actively reporting to ossec master, moves to disconnected status. On analysis I was able to find out that client.keys the agent details where missing. But not sure why this happens. Most of the agents details seems to be missing on daily basis. Can someone please help me here.
1 Answer
to reactive the ossec agent run the following command
cd /apps/ossec/bin/
sudo su
./ossec-control restart
