Some agents remains in pending state

[Carlos Lopez]

Hi all,

Sometimes when I am doing some modifications in shared configs, my agents remains in "pending" state ... Which could be the reason?

I am using release 4.1.2 in managers and agents.

Regards.

[Victor M Fernandez-Castro]

Hi Carlos,

The state pending is normally a transition between disconnected and active. Pending means that the manager has received the connection attempt from the agent (the STARTUP message). This is the connection handshake:

1. The agent reaches the manager and sends "HC_STARTUP". The manager validates the agent authorization and sets the state to Pending.
2. The manager sends "HC_ACK" to the agent. The agent logs that it is now connected, and periodically delivers heart-beat messages to the manager.
3. Those heart-beats make the manager set the agent's status to Active.

The first image at PR #6396 illustrates this flow.

Normally, agents remain in a pending state for less than a second. However, the cluster synchronizes the state every 10 seconds with the default configuration. So, some agents may show as pending for a few seconds if they have just restarted. There is a particular case when connecting in UDP mode: if the firewall is allowing traffic agent → manager but blocking traffic manager → agent, those agents will permanently be as Pending.

Hope it helps.

Best regards,

Victor M. Fernandez-Castro 
Director of engineering | vic...@wazuh.com

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/PR3PR07MB6617DB556C8BF652C5E9C477DB7D9%40PR3PR07MB6617.eurprd07.prod.outlook.com.

[Carlos Lopez]

Concise and clear.

Many thanks Victor as always.,

________________________________________
From: Victor M Fernandez-Castro <vic...@wazuh.com>
Sent: 30 March 2021 12:53
To: Carlos Lopez
Cc: wa...@googlegroups.com
Subject: Re: Some agents remains in pending state

Hi Carlos,

The state pending is normally a transition between disconnected and active. Pending means that the manager has received the connection attempt from the agent (the STARTUP message). This is the connection handshake:

1. The agent reaches the manager and sends "HC_STARTUP". The manager validates the agent authorization and sets the state to Pending.
2. The manager sends "HC_ACK" to the agent. The agent logs that it is now connected, and periodically delivers heart-beat messages to the manager.
3. Those heart-beats make the manager set the agent's status to Active.

The first image at PR #6396<https://github.com/wazuh/wazuh/pull/6396> illustrates this flow.

Normally, agents remain in a pending state for less than a second. However, the cluster synchronizes the state every 10 seconds with the default configuration. So, some agents may show as pending for a few seconds if they have just restarted. There is a particular case when connecting in UDP mode: if the firewall is allowing traffic agent → manager but blocking traffic manager → agent, those agents will permanently be as Pending.

Hope it helps.
Best regards,

[https://s3.amazonaws.com/wazuh.com/wp-content/uploads/wazuh_logo.png]<https://wazuh.com/>
Victor M. Fernandez-Castro
Director of engineering | vic...@wazuh.com<mailto:vic...@wazuh.com>

On Tue, Mar 30, 2021 at 8:45 AM Carlos Lopez <clo...@outlook.com<mailto:clo...@outlook.com>> wrote:
Hi all,

Sometimes when I am doing some modifications in shared configs, my agents remains in "pending" state ... Which could be the reason?

I am using release 4.1.2 in managers and agents.

Regards.

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.

To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com<mailto:wazuh%2Bunsu...@googlegroups.com>.