Limit for log files is set at the MS max which if I remember right is around 256mb.
-----Original Message----- From: [email protected] [mailto:[EMAIL PROTECTED] On Behalf Of McClinton, Rick Sent: Thursday, January 31, 2008 11:24 AM To: [email protected] Subject: [ossec-list] Re: 1.4 client cpu usage I hadn't seen an issue like this yet. What is your limit for event log sizes? Thanks Rick > -----Original Message----- > From: [email protected] [mailto:[EMAIL PROTECTED] On > Behalf Of Herb Steck > Sent: Thursday, January 31, 2008 11:04 AM > To: [email protected] > Subject: [ossec-list] Re: 1.4 client cpu usage > Importance: Low > > > Well, after an hour of it I needed to figure out what was going on. > > On the server I rebooted last night I removed the section for the Event > logs > in the config file. Restarted the service and it was ok. I then cleared > out the event logs, put the config back to original and restarted the > service again. No problems. > > Looks like the issue has something to do with going through the even logs. > > -----Original Message----- > From: [email protected] [mailto:[EMAIL PROTECTED] On > Behalf Of Derek J. Morris > Sent: Thursday, January 31, 2008 6:14 AM > To: [email protected] > Subject: [ossec-list] Re: 1.4 client cpu usage > > > I have it even higher on my servers both 32 adn 64 bit, running around > 90%. > After a few minutes it settles down though. I would like to know what it > is > too! > > > I have some servers (both 32 & 64bit) Windows 2003 R2 servers that after > > reboot the ossec service & lsass.exe start to take over the cpu running > at > > about 50% utilization. What can be causing this? Anyone have any > ideas? > > > > > > > > All servers are running latest MS updates & service packs. > > > > >
