[ossec-list] Frequent disconnects of agent on Dell PowerEdge 2950 Windows Storage Server 2003 R2Standard Edition x64, HardwareRAID

["Peter M. Abraham" <peter.m.abraham@xxxxxxxxx>]

Greetings:

We currently are testing OSSEC 1.3 on 25 servers including 3 Window
2003 servers.

Two of the Window 2003 servers are running regular 32-bit Windows 2003
server; but the third one is running 64-bit plus also using the
storage server edition.

All three are to the latest Microsoft patch level including the
patches released yesterday, 8-14-2007.

The 64-bit Window server agent regularly (typically within a few hours
of starting the agent) disconnects from the server.

In the ossec log on the agent side, every time there is a disconnect I
notice lines as follows:


2007/08/15 10:33:51 ossec-agent: Event count after '20000': 4139566-
>3496696 (84%)

2007/08/15 11:45:53 ossec-agent: Server unavailable. Setting lock.

2007/08/15 11:45:56 ossec-agent: Server responded. Releasing lock.

2007/08/15 12:31:26 ossec-agent: Server unavailable. Setting lock.

2007/08/15 12:31:29 ossec-agent: Server responded. Releasing lock.

2007/08/15 13:03:59 ossec-agent: Server unavailable. Setting lock.

2007/08/15 13:04:02 ossec-agent: Server responded. Releasing lock.

2007/08/15 13:35:32 ossec-agent: Server unavailable. Setting lock.

2007/08/15 13:35:35 ossec-agent: Server responded. Releasing lock.


Is there anything I can do on my end to improve how long the agent
stays connected?

Thank you.