You can check this link http://www.ossec.net/main/manual/manual-syscheck/realtime-file-integrity-monitoring/
You can also set the frequency in ossec.conf to whatever you like. Hope this helps. Typos, courtesy of the wireless device. -----Original Message----- From: Christopher Moraes <[email protected]> Sender: [email protected] Date: Tue, 21 Sep 2010 12:17:52 To: <[email protected]> Reply-To: [email protected] Subject: [ossec-list] Performance testing of OSSEC Hello everyone, I have just joined the ossec-list. I am evaluating (performance testing) OSSEC for my organization to see whether OSSEC can handle a volume of 2500-3000 events per second. I have created the following test setup - - Dual Core Linux server with 4 GB RAM - OSSEC is installed on this server (local mode) and is configured to monitor 4 log files, which I am filling using a script. I ran the test yesterday and OSSEC updated the stats folder only at eod. Is there anyway to get OSSEC to report on the stats either i. in real time? ii. at least every hour? Thanks and regards, Chris
