Some missing logs while disconnecting networks.

Skip to first unread message


Feb 27, 2020, 8:55:40 PM2/27/20
to ossec-list

Between a manager and a linux and a windows agent, some logs are missing during a network cable disconnecting.
I checked it in "archive.json" file which doesn't contain some logs.
I tested in under a buffer disabled and a buffer normal situation.
What's wrong in my situation or testing?

Many thanks.

Nobel Jung

José Manuel López del Río

Sep 9, 2020, 3:13:18 PM9/9/20
to ossec-list
While an agent is disconnected, it will stop monitoring the log files configured to monitor, and therefore, it should only lose the logs that were being sent at the same moment that the communication got interrupted, independently of the buffer. The time that the agent can verify its disconnection and stop monitoring files will be much shorter when using the TCP protocol, and therefore, the logs loose would be decreased.

All the new logs ingested into the log file while the agent is disconnected should be sent to the Manager side once the agent reconnects.

You could perform a test by monitoring a specific log file, disconnecting the agent, then introducing new log lines to the monitored file, and monitoring the archives.json once the agent reconnects. You should be able to verify that all the logs ingested during the disconnection were sent once it reconnected.

I hope this helps.
Jose Manuel Lopez
Reply all
Reply to author
0 new messages