On the ossec master there is a syscheck database for each agent (in /
var/ossec/queue/syscheck).
If the syscheck database has not been updated for a while (i.e. longer
than the interval between runs of the syscheck on the agent) does this
indicate that
1) Nothing being monitored has changed so the database does not need
to be updated?
or
2) There is a problem, either on the agent or with forwarding the
database to the master?

Reply via email to