On Fri, Dec 17, 2010 at 4:52 AM, carlopmart <[email protected]> wrote:
> Hi all,
>
> I have installed two ossec servers to provide HA for several agents. Using
> a software load balancer, this scenario works as I expected. But I have a
> problem with six servers (all linux based) that resides on the same OSSEC
> servers subnet.
>
> I can't use a load balancer in this subnet. Then,
>
> a) Is it possible to configure at some place on the host agent side how
> long logs should be kept locally??
>
No. Well nothing in OSSEC. The system logs will last as long as the
system is configured to store them.
> b) When OSSEC server go up, does the agent detects that the server is up?
> Or rather, is the server which will contact the agent?? I assume that when
> this happens, the server will get all the logs of the agent, correct?
>
I don't know how agents deal with one server coming back up. I don't
think they switch back over to the primary automatically.
> Thanks.
>
> --
> CL Martinez
> carlopmart {at} gmail {d0t} com
>
