On Wed, Nov 24, 2010 at 10:57 AM, ItsMikeE <[email protected]> wrote: > On the ossec master there is a syscheck database for each agent (in / > var/ossec/queue/syscheck). > If the syscheck database has not been updated for a while (i.e. longer > than the interval between runs of the syscheck on the agent) does this > indicate that > 1) Nothing being monitored has changed so the database does not need > to be updated? > or > 2) There is a problem, either on the agent or with forwarding the > database to the master?
My guess would be "yes." It could be either. Looking through the ossec.log on the agents or manager could yield information about errors sending syscheck updates or writing to the db. I haven't looked at the syscheck db files recently enough to remember if they contain any timestamps (for anything other than changes to files). You could change a file on one of the systems that hasn't had a db update in a while to see if the db is updated after the next syscheck run. It could be as simple as adding a file to a monitored directory.
