Thank you, this is a great lead. I searched for a few terms on the ossec website, apparently didn't use the most obvious terms. ;)
I bought a copy of the book and read through it last night: I wished it would have discussed how to achieve the 3-layer architecture of multiple managers, as depicted in Michael Starks' OSSEC 2009 slide deck (e.g. for scale), and best practices on how to automate agent activation and distribution. I guess that will come with experimentation. Pointers or tips on if/how to scale to thousands of managed agents would be appreciated. Cheers, Bill On Aug 10, 5:23 am, "dan (ddp)" <[email protected]> wrote: > This may help:http://www.ossec.net/wiki/Errors:LargeNumberAgents > > On Mon, Aug 9, 2010 at 9:57 PM, x509v3 <[email protected]> wrote: > > I see this when I startup: > > 2010/08/09 18:34:20 ossec-remoted(4111): INFO: Maximum number of > > agents allowed: '256'. > > > How can I configure the system to support more remote agents, and > > what's the max practical limit? > > > Do I just need to purchase a support contract to "unlock" more remote > > agents supported? > > > Thanks, > > > Bill
