I am running an OSSEC server compiled to handle 10K hosts with over 1K already deployed. In 2 weeks I will be doubling my hosts and by the end of April I will have over 4K.
Taking in events via native ossec and sending via remote rsyslog to parse. Roughly 200K events an hour. Server is RH EL on a VM with only 4g ram and dual proc. So far no issues to report on the RH server. I will keep you informed if I notice any scalability issues. --Shawn On Sat, Mar 31, 2012 at 7:45 PM, Dan Sherman <[email protected]> wrote: > I would like to know as well. > > Dan > > On Mar 31, 2012, at 5:44 PM, Zate <[email protected]> wrote: > >> Anyone running OSSEC on 1000+ hosts that wants to share some tips/ >> tricks on a good architecture for large installs? Hardware tips, >> deployment tips, management tips? >> >> Dont mind discussing off list if that makes it easier. >> >> thanks. -- Regards, Shawn Romines [email protected] 210-233-9619
