Duplicate Agent on Ubuntu-22 (one active, one disconnected) – How to clean it up?

[elferdaous Mejhed]

The problem is that I originally configured a Wazuh agent for a machine named Ubuntu-22. Then suddenly another agent appeared (the same machine/Ubuntu-22 but with an old/previous name), now one is connected/active and the other is disconnected. How can I resolve this?

[Olamilekan Abdullateef Ajani]

Hello Elferdaous,

This happens when the agent gets re-registered with a new name or key (for example, after a hostname change or reinstall). The manager then treats it as a new agent, so the old entry remains but shows as disconnected.

In the screenshot you shared, the active agent is the one currently reporting in, so what you can do is simply remove the old disconnected entry from the manager and leave the active one as is.

On the manager, run /var/ossec/bin/manage_agents

Then type R, which means "remove agent," and then enter 002, which is the agent ID.

Verify the agent has been removed.

Please let me know if you require further assistance on this.

Ref:
https://documentation.wazuh.com/current/user-manual/reference/tools/agent-control.html

[elferdaous Mejhed]

Merci , 

Je veux savoir si les modifications dans les fichiers dans cet agent et toutes les configurations restent si je supprime l'ancien agent et je garde celui avec l'id 003 ? ( Sont ils copiées automatiquement dans le deuxième agent )

Ça dérange pas ?, ou tu préfères que je supprime les deux et je réinstalle le de le début.

Merci encore pour votre retour.

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/48fe92f6-7f81-4bc5-9a86-3d8f9a240215n%40googlegroups.com.