I have check the log, a syscheck operation starts and ends for around 11 minutes (using the default configuration).
On May 9, 12:50 am, "dan (ddp)" <[email protected]> wrote: > On Tue, May 8, 2012 at 12:24 PM, Sun Poon <[email protected]> wrote: > > Dear Sir/Madam, > > > I deployed OSSEC as a HIDS agent to a big old system (SUSE 9 without > > inotify) in our company. Being required by my boss, it is essential > > for me to report critical file changes ASAP to various system owners. > > > With the limitation, I decided to use frequent syscheck to replace the > > real-time features. I set the frequency to <frequency>900</frequency>, > > I have also disabled the auto-ignore feature. However, it is > > discovered that the file change event appears 30 minutes later, or > > even not showing up. I have checked that the database is not empty by > > using ossec-wui. Is there any configuration error I have made? > > > Best Regards, > > Sun > > How long does a scan take? I can't imagine a scan of any decent size > taking less than 900 seconds.
