On 2013-11-14 9:55, [email protected] wrote:
Hi, I have 5 servers sharing the same NFS folder for /var/ossec, and
it seems to be working. I've inherited this architecture.
Right now, we have about 3000 clients that connect to an F5 vip, and
then each client reports to this VIP. In the vip are 5 servers sharing
the same /var/ossec nfs folder.
My question is, does this architecture work? I mean, Im having issues
with some clients not connecting and I'm not sure that the correlation
would work properly, it depends if all the ossec correlation reads
always from disk and does not save information to memory.
The only thing I can think of that might be a problem is the rids. Check
ossec.log to see if anything is being denied.
--
---
You received this message because you are subscribed to the Google Groups "ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
