On Thu, Aug 26, 2010 at 12:11 PM, jplee3 <jpl...@gmail.com> wrote: > Thanks all for the info! So as far as from a security standpoint, it's > probably better to go with agent rather than agentless. Also, from a > performance standpoint this seems to make more sense. In short, go > with the agent where you are able to and agentless where you > absolutely cannot. >
Correct. > My remaining concern is with performance impacts of putting the agent > on a machine that often gets taxed (which is why I was considering > agentless in the first place). And though it sounds like the footprint > is smaller, the determining factor will likely have to be just trying > it out on a test or staging system either way. > > Definitely test it out. Syscheck seems to be the biggest performance hog on the agent side, but there are a few syscheck settings that can help with performance (including scheduling syscheck scans to run at certain times).
