[ossec-list] Re: What happens if the ossec server is down?

["Noel Sanchez" <noel@xxxxxxxxxxxxxxxxxx>]

From what I understand, Active Response is only on the server, not the
agents.



Noel



>
> El mar, 17-07-2007 a las 21:22 -0300, Daniel Cid escribió:
>> Hi Paco,
>>
>> Joking aside, the agent will detect that the server is down (after a
>> few minutes without
>> the keep alive messages) and stop reading/sending events until it is
>> back up (it will
>> detect when the server is back again).
>
> And what happen whith the active responses? I'm not sure if the active
> responses are generated by the agent o by the server :(
>
> --
> Paco Avila <pavila@xxxxxx>
>
>