Is that a lot? I buy in bulk. And I figured some of /var/ossec/queue would be ok to save. Maybe just get rid of the big files. On Oct 19, 2011 10:12 PM, "Kat" <[email protected]> wrote:
> it sucked up over 2G and was still running! > > On Oct 19, 8:49 pm, "dan (ddp)" <[email protected]> wrote: > > # ls -l /var/ossec/queue > > total 36 > > drwxr-xr-x 2 ossecr ossec 512 Oct 18 18:56 agent-info > > drwxr-xr-x 2 ossec ossec 512 Feb 14 2011 agentless > > drwxrwx--- 2 ossec ossec 512 Oct 17 10:22 alerts > > drwxr-x--- 10 ossec ossec 512 Oct 11 09:53 diff > > drwxr-x--- 2 ossec ossec 512 Feb 14 2011 fts > > drwxrwx--- 2 ossec ossec 512 Oct 17 10:22 ossec > > drwxr-xr-x 2 ossecr ossec 512 Oct 18 18:55 rids > > drwxr-x--- 2 ossec ossec 512 Oct 18 18:57 rootcheck > > drwxr-x--- 2 ossec ossec 1024 Oct 19 17:07 syscheck > > > > I'm not sure why a large syscheck would have necessitated destroying > > the entire directory. An in place upgrade (rerun install.sh and let it > > upgrade the system) might also work. >
