Hi Michael, Is there any way you can install Process Explorer on one of these boxes?
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx When you run it, click on the ossec-agent process and look at the "Performance" and "Performance Graph" tabs... If you can take a screenshot, it will help me debug the issue. Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Tue, Sep 9, 2008 at 8:36 AM, Michael Ward <[EMAIL PROTECTED]> wrote: > > We're using the Blackboard system for classroom content delivery > consisting of a file server, a database server, a collaboration > server, and two web servers. All are running on Dell hardware with at > least dual quad processors and 4G with Windows 2003. We just upgraded > from 1.5 to 1.6 on Friday and noticed that memory usage jumped up to a > max of 550M on one of the webservers. The file server (which is the > AD controller for this small domain). These numbers come from the > Task Manager. What other information should I gather? > > > mjw > > > > On Sep 8, 2008, at 8:27 PM, Daniel Cid wrote: > >> Hi Michael, >> >> This is not normal at all. On all my systems it is not even going >> above 10/15M, so I can't >> reproduce it. Is anyone else seeing this issue? >> >> *on v1.6, I started caching some libraries for the event log reader, >> but that shouldn't >> use anything close to that. >> >> **Is there anything non-standard that could help us reproduce it? >> >> Thanks, >> >> -- >> Daniel B. Cid >> dcid ( at ) ossec.net >> >> >> On Mon, Sep 8, 2008 at 11:39 AM, Michael Ward <[EMAIL PROTECTED]> >> wrote: >>> >>> I've noticed that the new OSSEC (1.6) client can use up to 1G of RAM, >>> is this normal? If so, I won't be able to keep it on some of my >>> servers. >>> >>> >>> mjw >>> >>> >>> >>> >>> >>> Michael Ward, Ed.D >>> UT Chattanooga - ARCS, IT Security >>> 615 McCallie Ave Dept 4324 >>> Chattanooga, TN 37403 >>> 423-425-4764 >>> FAX:423-425-4362 >>> >>> >>> >>> >>> >>> > >
