OSSEC isn't really built for multiple cores. Are you pushing enough data through it to consume a whole core? How many eps?
On Wed, Dec 7, 2011 at 9:25 AM, Kat <[email protected]> wrote: > Just wondering if there is any trick either at build time or runtime > to convince ossec-analysisd to use more than a single core in a large > CPU rich system. I have 8 cores and no matter what it just doesn't > want to use more than one. I guess I could look at the code, not sure > if it is able to use more than one. > > thanks > ~k
