'syscheck_control -u <agent_id>' delete the syscheck history database file for this agent on OSSEC server. It's a way to reduce unwanted alerts, say, after the agent machine was patched. It does not delete anything on the agent machine.
On Tuesday, March 5, 2013 3:50:10 PM UTC-8, dan (ddpbsd) wrote: > > On Mon, Mar 4, 2013 at 12:39 PM, Kat <[email protected] <javascript:>> > wrote: > > Just wondering if I am missing something. I have an agent that has used > too > > much space for syscheck changes. I want to re-init with new rules. If I > run > > syscheck_control with -u it says it will INIT the database, but the > "old" > > stuff is still there. So I have to get on every system to clear the old > junk > > and wasted space? Am I missing something here? > > > > thanks > > > > I think you'll just have to stop the processes and clear the files > manually. > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/groups/opt_out. > > > > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
