I think the syscheck process will kick off sometime after the time it is supposed to (either via frequency or scan_time/day), but how quickly after that time depends on the system load and similar factors (kind of like cron). I'll have to setup a scan_time/scan_day to see if it's working for me, I haven't played with it.
On Fri, May 21, 2010 at 3:24 AM, Adi CHIRU <[email protected]> wrote: > I do not the scans run anymore, although I did not waited 6 hours (which I > understant is the default time) to see that. > When activated the scan_time and scan_day directives on server I disabled > frequency; should I have left it enabled? > Also, when frequency is enabled with 1800 sec. (30 min.) the scans actually > start from 40 to 40 minutes. Is this normal behaviour? > The date from server and clients is kept synchronized all the time - the > corrections made when necessary are of a value below 0.5 sec. > > Thanks, > Adi > > -----Original Message----- > From: [email protected] [mailto:[email protected]] On > Behalf Of dan (ddp) > Sent: Thursday, May 20, 2010 10:07 PM > To: [email protected] > Subject: Re: [ossec-list] <scan_time> and <scan_day> seem to have no effect > > Do the syscheck scans actually run at some point? If so, how often? > When do they run in relation to the settings you configured? > > On Thu, May 20, 2010 at 10:20 AM, Adi CHIRU <[email protected]> wrote: >> Hi, >> >> >> >> I have encountered another problem with my testing: >> >> I have commented out the <frequency> tags and added the <scan_time> and >> <scan_day> tags in oder to control exactly when syscheck will start. >> However, although there are no errors at start time about these parameters >> and their values, nothing actualy happens at the configured time/day. >> >> Is there someone who managed to make this work? >> >> >> >> Thanks, >> >> Adi >
