That might be the reason to the problem. But how about the missed alert cases? I wonder if problem would occur if I set the frequency to high :/ But my boss insist on making this "real-time".
On May 9, 1:05 am, "dan (ddp)" <[email protected]> wrote: > On Tue, May 8, 2012 at 12:57 PM, Sun Poon <[email protected]> wrote: > > It's around 11 minutes according to the log. > > Perhaps the <frequency>900</frequency> begins counting after the > completion of the previous scan? > > > > > > > > > > > On Wednesday, May 9, 2012 12:50:31 AM UTC+8, dan (ddpbsd) wrote: > > >> On Tue, May 8, 2012 at 12:24 PM, Sun Poon <[email protected]> wrote: > >> > Dear Sir/Madam, > > >> > I deployed OSSEC as a HIDS agent to a big old system (SUSE 9 without > >> > inotify) in our company. Being required by my boss, it is essential > >> > for me to report critical file changes ASAP to various system owners. > > >> > With the limitation, I decided to use frequent syscheck to replace the > >> > real-time features. I set the frequency to <frequency>900</frequency>, > >> > I have also disabled the auto-ignore feature. However, it is > >> > discovered that the file change event appears 30 minutes later, or > >> > even not showing up. I have checked that the database is not empty by > >> > using ossec-wui. Is there any configuration error I have made? > > >> > Best Regards, > >> > Sun > > >> How long does a scan take? I can't imagine a scan of any decent size > >> taking less than 900 seconds.
