Was wondering if anyone has tried this? We'd like to move OSSEC to production on a pair of load balanced hosts. Assuming a shared file system in which /var/ossec is stored, can both servers be active or should one be passive and one active?
Appreciate any comments from those who might have experience in this area. Cheers! TM
