Agents in Pending Status

[Khul Sat]

Hi!

From past couple of day, I have been observing that after a reboot, agents are going into 'Pending' state.

I have to manually restart the wazuh-agent to make it 'active'.

Any idea what could be the reason?

The recent change to my knowledge is, `wazuh-agent` package got updated on majority of the servers wherein `ossec` user/group became absolute and `wazuh` user/group came in picture.

Could that be a reason?

Thanks,

KS

[Dario Menten]

Hello Khul,
Thank you for posting in the community.
This status is because of the registration of an agent has been made and there is no communication between the agent and the manager. See this for more information: https://documentation.wazuh.com/current/user-manual/agents/agent-life-cycle.html#agent-status
I see you say the agent goes from active to pending, this could mean there is an automatic registration in progress (you can see the agent ID changes). To check if this is the case please check if you have a script configured somewhere that is making the registration.
In Wazuh 4.3 by default when the agent can not connect to de manager, after some retries it tries for a new registration to the manager. Having said that, please check if you have any networking issues that can cause this behavior.
This threshold is managed by these configurations: https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/global.html#agents-disconnection-time

<agents_disconnection_time>1m</agents_disconnection_time>

I hope this information could be helpful.

​

[Khul Sat]

Hello Dario,

Thank you for your response. Here are my comments-

1. I doubt there will be a communication issue as I could telnet / ping manager from 'pending' client. It works as expected.

2. I have been observing this issue on the clients whose agent got updated recently. Agent is active before an upgrade. When agent gets rebooted, it goes into 'pending' state.

3. Could you please help me with the location where script could have been configured?

4. I shall check the threshold and update you.

Regards,

[Khul Sat]

Hello.. Any comments/thoughts?

[Dario Menten]

Hello Khul,

Sorry for the late reply.

Have you checked the threshold?

The script I mention could be a custom script located everywhere, also if the agents are placed in Windows Systems could be that they are being deployed by GPO.

Can you please share some information about the environment? OS Platform and version, Wazuh Agent and Manager versions. Thank you.

I hope this could be helpful.

[swaps]

Hello.. Sorry for the late reply!

Was little occupied.. Threshold is default & there is no script found.

Agents are 95% Unix based (RHEL 6/7, CentOS 6/7, Ubuntu 14/18/20).

Wazuh setup is running on version - 4.3.10.

Thanks!