On the ossec master there is a syscheck database for each agent (in / var/ossec/queue/syscheck). If the syscheck database has not been updated for a while (i.e. longer than the interval between runs of the syscheck on the agent) does this indicate that 1) Nothing being monitored has changed so the database does not need to be updated? or 2) There is a problem, either on the agent or with forwarding the database to the master?
- [ossec-list] syscheck database ItsMikeE
- Re: [ossec-list] syscheck database dan (ddp)
