Hi Denis, That's something that we can think about implementing, but would be dependent on the platform it is running (would not work everywhere). I also find it very strange that your load average is going that high, just because of OSSEC shutting down. Are you sure that's the real cause of the problem? I run it on OpenBSD too and never had similar issue (and my pf table grows quite big).
Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Feb 14, 2008 2:27 PM, Denis Shaposhnikov <[EMAIL PROTECTED]> wrote: > > Hello, > > On Tue, 12 Feb 2008 17:05:02 +0300 > Denis Shaposhnikov <[EMAIL PROTECTED]> wrote: > > > So, it would be good if ossec run active-response script with arg > > "stop" on shutdown event. > > I mean that on this command it possible just to do pfctl -t > ossec_fwtable -T flush and flush all the table instead of ip by ip. > > > -- > DSS5-RIPE DSS-RIPN mailto:[EMAIL PROTECTED] xmpp:[EMAIL PROTECTED] > http://wizard.volgograd.ru/ 2:550/[EMAIL PROTECTED] 2:550/[EMAIL PROTECTED] >
