On Tue, Jan 22, 2013 at 6:09 PM, Nadeem Khan <[email protected]> wrote: > I have an issue with ossec server/client ver 2.5.1 , where i have 50+ ossec > agent running on 1 location and it is trying to connect to ossec server over > 10 mb WAN connection , the WAN link is 100% utilize and network comes to a > Halt if i look at logs most of the connection is coming from ossec agent and > the only way to prevent this is to block the port udp 1514 on the WAN > Router. > > I have ossec agent running on the different location may be 4 or 5, which > are working fine. Looks like it is the issue with more agents running at a > location? > > anybody sees these kind of issue? > > thanks for the help in advance.
What kind of logs is OSSEC sending across? That might be indicative of a problem on your network.
