Agent ID reuse in ossec server

[Macie Lee]

Once an agent ID being added to ossec server, it seem can not be reused, even after your remove the agent or stop and restart ossec server. The ID will keep increase. Is there any way to get around that?

[Daniel Cid]

Hi Macie,

Is there a reason why you need it? The manage_agents tool doesn't
allow you to duplicate
ids (even after deleting) because internally it still uses it to link
to old events, message ids, etc.
If you re-use the id, the manager may treat the new agent as if it was
the old one and may
cause some errors. So, I wouldn't do that if I were you :)

Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net

[Sebastián Martín Labonia]

Hi Daniel,

Your reasons are valid, but what if i want to start again without reinstall the server?

Thats my situation. I want to standarize the Agent ID with the last octet of the agent IP address. Cant it be done? Even deleting all the old events and alerts...

Thanks!

[dan (ddp)]

On Fri, Dec 14, 2018 at 8:32 AM Sebastián Martín Labonia
<smla...@gmail.com> wrote:
>
> Hi Daniel,
>
> Your reasons are valid, but what if i want to start again without reinstall the server?
>
> Thats my situation. I want to standarize the Agent ID with the last octet of the agent IP address. Cant it be done? Even deleting all the old events and alerts...
>

Delete the client.keys file, queue/agent-info/*, queue/syscheck/*,
queue/rids/*, queue/rootcheck/*, queue/diff/*, queue/fts/* on the
server

> Thanks!
>
> El lunes, 16 de marzo de 2009, 14:55:08 (UTC-3), Daniel Cid escribió:
>>
>> Hi Macie,
>>
>> Is there a reason why you need it? The manage_agents tool doesn't
>> allow you to duplicate
>> ids (even after deleting) because internally it still uses it to link
>> to old events, message ids, etc.
>> If you re-use the id, the manager may treat the new agent as if it was
>> the old one and may
>> cause some errors. So, I wouldn't do that if I were you :)
>>
>> Thanks,
>>
>> --
>> Daniel B. Cid
>> dcid ( at ) ossec.net
>>
>> On Thu, Mar 12, 2009 at 11:34 AM, Macie Lee <leem...@yahoo.com> wrote:
>> > Once an agent ID being added to ossec server, it seem can not be reused,
>> > even after your remove the agent or stop and restart ossec server. The ID
>> > will keep increase.
>> >
>> > Is there any way to get around that?
>> >
>> >
>

> --
>
> ---
> You received this message because you are subscribed to the Google Groups "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.