I just realized why you were asking about logcollecrtoring ossec.log. It seems to be what may cayse the looping of that error.
Sent from my Verizon Wireless Phone -----Original Message----- From: dan (ddp) <[email protected]> Sent: Monday, August 08, 2011 7:49 AM To: [email protected] Subject: Re: [ossec-list] Re: Recompiling ossec-logcollector and full command? Have you traced it back to the beginning? To see what message started the chain? And are you logcollectoring ossec.log? On Mon, Aug 8, 2011 at 10:31 AM, jplee3 <[email protected]> wrote: > BTW: The initial cause of this issue seems to be related to requests > too long for OSSEC to handle. But OSSEC shouldn't grow the logs so > tremendously huge when it encounters multiple events that are too > large. I think this might be a bug. This is a snippet of what I see > when looking at an ossec.log that has grown out of control > > "'2011/08/07 23:38:01 ossec-logcollector: Large message size: > '2011/08/07 23:38:01 ossec-logcollector: Large me > ssage size: '2011/08/07 23:38:01 ossec-logcollector: Large message > size: '2011/08/07 23:38:01 ossec-logcollector: > Large message size: '2011/08/07 23:38:01 ossec-
