On Thu, Mar 10, 2011 at 10:21 PM, lil <[email protected]> wrote: > My question is: can we do the setmaxagents command and increase this number > without reinstalling OSSEC? If we do have to reinstall OSSEC, will it > 'break/change' anything we've already setup? > > It would have been very nice to see this in the documentation > (book/website) before we installed it. > > Thank you in advance for any help you can give.
Hi Lillian, yes you need to recompile/reinstall (but don't get rid of your data files and custom rules!), no you should be able to increase the max agents without any breakage. This option is documented any number of different places[*], but most notably not many places in the manual that I can see[**] * many blogged install guides to OSSEC and large scale deployments mention this, ie http://www.immutablesecurity.com/index.php/2010/10/20/2woo-tips-tricks/ ** http://www.ossec.net/doc/faq/unexpected.html?highlight=setmaxagents -- http://kacper.doesntexist.org http://windows.dontexist.com Employ no technique to gain supreme enlightment. - Mar pa Chos kyi blos gros
