Yep -- sending 1800 agents to a single server so it has a lot to analyze. I am finding that this causes many of the agents to show "disconnected" because they can't get to the server while it is processing very busy nodes. So rather than throw additional servers at it, I have all the cores, but I am maxing out a single core and the others just sit there. :-(
On Dec 8, 9:09 am, "dan (ddp)" <[email protected]> wrote: > OSSEC isn't really built for multiple cores. Are you pushing enough > data through it to consume a whole core? How many eps? > > >
