----- "dan (ddp)" <[email protected]> wrote: | On Mon, Dec 28, 2009 at 10:52 AM, --[ UxBoD ]-- <[email protected]> | wrote: | > Hi, | > | > couple of ideas which would help of very busy systems; unless they | are already implemented: | > | > 1) Ability to schedule when syscheck runs; I appreciate you can set | the schedule but you cannot set the time when it runs. If you have | another process causing a lot of I/O you can get a bottleneck | > 2) Ability to set the nice level of the running process; does it | really need to run at '0' | > | > Thoughts ? | > | > Best Regards, | > | > | | 1. Doesn't the scan_time option do this? | http://www.ossec.net/main/manual/manual-syscheck/#config | 2. Just renice them to your liking. Which processes are you having | issues with specifically?
Dan, 1. Was reading the book; oops! :) 2. syscheckd is the one which appears to eat a lot of I/O. We could set /etc/security/limits.conf but if would be nice (pardon the pun) if it could be centrally managed via shared/agent.conf with a new parameter. Thanks,
