On Tue, Apr 1, 2014 at 8:37 PM, Julien T <[email protected]> wrote: > > > > 2014-04-01 20:28 GMT-04:00 dan (ddp) <[email protected]>: > >> >> Definitely possible. It's hard to debug when I can't recreate the issue. > > > Of course, I'm just trying to find what I can do to localize more the issue. > >> >> >> It's possible. If the code checks the current time, knowing the >> timezone would make sense. Your original email only listed 7 attempts >> >> at accessing the localtime file though, or did I misread something? > > > 7 attempts for 60s sampling if I remember correctly. but tool like rwsnoop > seems to show access more once every 1-2 seconds. >
If you can track down the parts of the code that these checks are happening in it'll help. >> >> >> Syscheck accessing the syscheck database frequently makes sense >> though. It could be more efficient , but I don't think there are any >> current plans to move to another storage technology. > > > Even, when it's not generating/checking hash? > Are you sure the scan isn't running at the time? It shouldn't be doing much of anything when it isn't scanning. If it's happening when there is no scan going on, I have no idea what it'd be doing. Unfortunately I don't think the actual developers pay much attention to the list. > my settings are the default > <frequency>72000</frequency> > syscheck.sleep=2 > syscheck.sleep_after=15 > > That does not seem to me as very intensive to me unless there is some very > big file scan. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
