Can somebody give some feedback in relation to the below please ; In the event an OSSEC core server was to go offline for an extended period of time will the agents keep storing syscheck alerts locally until the core comes back online?
If the agents do spool alert logs locally the risk is disk space on agents filling up. Any settings to prevent this? Lastly, the local agent log OSSEC.log. Anyway to limit the size! Thanks a lot. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/ossec-list/b17e88a1-db72-4063-9a35-1000cde08353%40googlegroups.com.
