Hi all,
I have installed two ossec servers to provide HA for several agents. Using a
software load balancer, this scenario works as I expected. But I have a problem with
six servers (all linux based) that resides on the same OSSEC servers subnet.
I can't use a load balancer in this subnet. Then,
a) Is it possible to configure at some place on the host agent side how long logs
should be kept locally??
b) When OSSEC server go up, does the agent detects that the server is up? Or
rather, is the server which will contact the agent?? I assume that when this
happens, the server will get all the logs of the agent, correct?
Thanks.
--
CL Martinez
carlopmart {at} gmail {d0t} com
