2014-04-01 20:28 GMT-04:00 dan (ddp) <[email protected]>: > > Definitely possible. It's hard to debug when I can't recreate the issue. >
Of course, I'm just trying to find what I can do to localize more the issue. > > It's possible. If the code checks the current time, knowing the > timezone would make sense. Your original email only listed 7 attempts at accessing the localtime file though, or did I misread something? > 7 attempts for 60s sampling if I remember correctly. but tool like rwsnoop seems to show access more once every 1-2 seconds. > > Syscheck accessing the syscheck database frequently makes sense > though. It could be more efficient , but I don't think there are any > current plans to move to another storage technology. > Even, when it's not generating/checking hash? my settings are the default <frequency>72000</frequency> syscheck.sleep=2 syscheck.sleep_after=15 That does not seem to me as very intensive to me unless there is some very big file scan. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
