2014-12-01 0:20 GMT+02:00 <[email protected]>: > Hi, > > In a test installation, I noticed that if I add /var/ossec directory in > the list of directories that syscheck should monitor, disk usage speeds up > really fast. In less than 2 hours, disk usage on on a test system doubled. > > What's the best practice for monitoring /var/ossec? I want to keep an eye > on what's going on inside that directory, but not use up that much disk > space. > > In general, what's the recommended method of monitoring a log directory? >
How about using samhain or auditd for that ? -- Eero -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
