Thanks Daniel for the reply. I am trying strongly to justify OSSEC as the primary logging analysis engine for my company. Co-workers of mine in the past have tried other software where the box would just get hammered. I am planning on testing this on one of our domain controllers but wanted the feedback like this.
I'll give it a shot and get back with some results or questions. Thanks, -Ed
