New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

httpry agent is not automatically reconnecting #131

Closed
GoogleCodeExporter opened this Issue Mar 24, 2015 · 2 comments

Comments

Projects
None yet
1 participant
@GoogleCodeExporter

GoogleCodeExporter commented Mar 24, 2015

When sguil-db-purge runs every day at 5:01 AM, it stops sguild, purges the DB, 
and then restarts sguild. httpry_agent is not automatically reconnecting to 
sguild like it's supposed to.  

Paul Halliday is looking at a proper fix for httpry_agent.  

In the meantime, you can add the following to the end of 
/usr/local/bin/sguil-db-purge:

# Restart httpry agent (bandaid)
/usr/local/sbin/nsm_sensor_ps-restart --only-httpry-agent

Original issue reported on code.google.com by doug.bu...@gmail.com on 12 Oct 2011 at 2:38

@GoogleCodeExporter

This comment has been minimized.

Show comment
Hide comment
@GoogleCodeExporter

GoogleCodeExporter Mar 24, 2015

I compared httpry_agent.tcl to ossec_agent.tcl and found the following in the 
latter:

 if { [llength $response] != 2 || [lindex $response 0] !=
"ConfirmEvent" || [lindex $response 1] != $NEXT_EVENT_ID } {

               # Send to sguild failed
               if { $DEBUG } { puts "Recv Failed" }

               # Close open socket
               catch {close $sguildSocketID}

               # Reconnect loop
               while { ![ConnectToSguilServer] } { after 15000 }
               return 0

           }

Paul made this change to httpry_agent.tcl and tested successfully.

Original comment by doug.bu...@gmail.com on 13 Oct 2011 at 3:35

  • Changed state: Started
  • Added labels: ****
  • Removed labels: ****

GoogleCodeExporter commented Mar 24, 2015

I compared httpry_agent.tcl to ossec_agent.tcl and found the following in the 
latter:

 if { [llength $response] != 2 || [lindex $response 0] !=
"ConfirmEvent" || [lindex $response 1] != $NEXT_EVENT_ID } {

               # Send to sguild failed
               if { $DEBUG } { puts "Recv Failed" }

               # Close open socket
               catch {close $sguildSocketID}

               # Reconnect loop
               while { ![ConnectToSguilServer] } { after 15000 }
               return 0

           }

Paul made this change to httpry_agent.tcl and tested successfully.

Original comment by doug.bu...@gmail.com on 13 Oct 2011 at 3:35

  • Changed state: Started
  • Added labels: ****
  • Removed labels: ****
@GoogleCodeExporter

This comment has been minimized.

Show comment
Hide comment
@GoogleCodeExporter

GoogleCodeExporter Mar 24, 2015

Fixed and published:
http://goo.gl/qpeVZ

Original comment by doug.bu...@gmail.com on 14 Oct 2011 at 11:37

  • Changed state: Verified
  • Added labels: ****
  • Removed labels: ****

GoogleCodeExporter commented Mar 24, 2015

Fixed and published:
http://goo.gl/qpeVZ

Original comment by doug.bu...@gmail.com on 14 Oct 2011 at 11:37

  • Changed state: Verified
  • Added labels: ****
  • Removed labels: ****
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment