Kat, Did you just work around the issue by having many ossec instances? Or did you somehow get beyond the CPU issue?
Thanks for your help! Brian On Thursday, December 8, 2011 8:45:42 AM UTC-8, Kat wrote: > > Yep -- sending 1800 agents to a single server so it has a lot to > analyze. I am finding that this causes many of the agents to show > "disconnected" because they can't get to the server while it is > processing very busy nodes. So rather than throw additional servers at > it, I have all the cores, but I am maxing out a single core and the > others just sit there. :-( > > On Dec 8, 9:09 am, "dan (ddp)" <[email protected]> wrote: > > OSSEC isn't really built for multiple cores. Are you pushing enough > > data through it to consume a whole core? How many eps? > > > > > > >
