I've got a couple of servers that handle 500k concurrent connections at any given time - I still want to be able to run syscheckd and rootcheck, but as you can guess, syscheck's netstat commands make the systems whine a lot, our load average charts are fun to look at...and netstat is pretty useless at that point anyway. Any way to disable these?
If it's a change I need to make in source that's fine as I build on- the-fly at deploy time, just would like to know the best way of doing it without turning off syscheck entirely...or breaking things - like, I'm pretty sure if I go in and comment out run_netstat in check_rc_ports.c, I will cause some havoc, so appreciate any guidance you guys might have on a simpler way of doing this. ;) Thanks a bunch in advance! - Jen
