On 07.12.2011 15:25, Kat wrote: > Just wondering if there is any trick either at build time or runtime > to convince ossec-analysisd to use more than a single core in a large > CPU rich system. I have 8 cores and no matter what it just doesn't > want to use more than one. I guess I could look at the code, not sure > if it is able to use more than one.
from what i saw the code is very much single-threaded. you could set up multiple ossec to spread the load but i wonder, do you have performance problems cpu-wise? if yes, do you have some figures (message rate, number of rules, etc.)? regards, -ap
