Hey Michael, You can manually force a syscheck from the ossec server with the following command:
# /var/ossec/bin/agent_control -r -u <agent_id> To decrease the amount of time a scan takes you could look at changing the following parameters in internal_options.conf (on the agent): syscheck.sleep=2 syscheck.sleep_after=15 Just remember that this could have a [significant] performance impact on the system. For more information check out these links: http://www.ossec.net/main/manual/manual-syscheck/ http://www.ossec.net/main/manual/manual-agent_control-tool/ http://www.ossec.net/wiki/index.php/Know_How:Syscheck_Perf cheers, cnk On Mon, Jun 15, 2009 at 6:25 PM, Michael Altfield<[email protected]> wrote: > > Hello ossec gurus, > > I was wondering if it is possible to force the execution of a > full-capacity re-scan of the files' checksum DB. > > Basically, when preforming system maintenance on a per-server basis, > I'd like to be able to: > 1) turn off ossec and disable alerting for this box in ossec.conf > 2) update the box with our current application version (modifying > monitored files and, thus, altering their checksums) > 3) issue a fast-as-possible rescan of the files on the server > (generate checksums of the new files), and > 4) restart ossec with alerting re-enabled > > Ideally, the only alerts that I will receive after this process are: > "ossec agent disconnected" and "ossec agent connected" > > The problem with this is: normally, ossec-syscheckd would be niced > *way* down so that #3 above would take an unreasonably high amount of > time. Is there a way to make it a #1 priority? > > > Cheers, > Michael Altfield >
