On Fri, Aug 13, 2010 at 4:26 PM, x509v3 <[email protected]> wrote: > Yes -- I've noticed that OSSEC doesn't immediately pickup changes from > master->agent. I've learned to be patient. :) > > That said, waiting hours or DAYS made no difference: although the > agent could communicate with the master and could be controlled by the > master, it wouldn't take a agent.conf. > > I made two changes: > 1) installed the latest snapshot > 2) accept the default of 256; and didn't try to increase the max > number of clients (I was testing a value of "10000" previously). > > I suspect that #2 was what introduced the failure case, but is > eventually a value I'd like to support. > > Going forward, it would be nice if the agent could be more responsive > to picking up changes from the master. Perhaps as an option for > "agent_control" to immediately push new configs. > > Thanks, > > bill
These two things might be worth putting into the ossec uservoice setup. 10,000 agents might be a bit much though... http://ossec.uservoice.com/forums/18254-general
