Duplicate Agent on Ubuntu-22 (one active, one disconnected) – How to clean it up?

[elferdaous Mejhed]

The problem is that I originally configured a Wazuh agent for a machine named Ubuntu-22. Then suddenly another agent appeared (the same machine/Ubuntu-22 but with an old/previous name), now one is connected/active and the other is disconnected. How can I resolve this?

[Olamilekan Abdullateef Ajani]

Hello Elferdaous,

This happens when the agent gets re-registered with a new name or key (for example, after a hostname change or reinstall). The manager then treats it as a new agent, so the old entry remains but shows as disconnected.

In the screenshot you shared, the active agent is the one currently reporting in, so what you can do is simply remove the old disconnected entry from the manager and leave the active one as is.

On the manager, run /var/ossec/bin/manage_agents

Then type R, which means "remove agent," and then enter 002, which is the agent ID.

Verify the agent has been removed.

Please let me know if you require further assistance on this.

Ref:
https://documentation.wazuh.com/current/user-manual/reference/tools/agent-control.html

[elferdaous Mejhed]

Merci , 

Je veux savoir si les modifications dans les fichiers dans cet agent et toutes les configurations restent si je supprime l'ancien agent et je garde celui avec l'id 003 ? ( Sont ils copiées automatiquement dans le deuxième agent )

Ça dérange pas ?, ou tu préfères que je supprime les deux et je réinstalle le de le début.

Merci encore pour votre retour.

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/48fe92f6-7f81-4bc5-9a86-3d8f9a240215n%40googlegroups.com.

[Olamilekan Abdullateef Ajani]

Hello again,

Deleting the old agent entry on the manager does not affect the system itself or the files on the machine. The configurations and any changes made on the host remain exactly as they are, because they are stored locally on the endpoint, not inside the agent record on the manager. Nothing is copied between the two agents, the active agent (003) is already the one communicating with the manager and using the configuration on the machine.

So in your case, there is no need to delete both agents or reinstall anything. Everything should continue working normally after that. You can refer to the attached screenshot for an example in my test environment. The only difference is not being able to capture live data since the other agent is not active.

Please let me know if you require further clarification.

[elferdaous Mejhed]

Ok merci beaucoup.

You received this message because you are subscribed to a topic in the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/wazuh/UfpKCp_6YeM/unsubscribe.
To unsubscribe from this group and all its topics, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/6c269d67-7fe8-453b-884b-b4caf58a19d0n%40googlegroups.com.