On 2014-11-30 17:39, Michael Starks wrote:
On 11/30/2014 04:20 PM, [email protected] wrote:
Hi,
In a test installation, I noticed that if I add /var/ossec directory
in
the list of directories that syscheck should monitor, disk usage
speeds
up really fast. In less than 2 hours, disk usage on on a test system
doubled.
What's the best practice for monitoring /var/ossec? I want to keep an
eye on what's going on inside that directory, but not use up that much
disk space.
In general, what's the recommended method of monitoring a log
directory?
This is what I do. Adjust accordingly:
<directories check_all="yes" realtime="yes"
report_changes="yes">/data/ossec</directories>
<ignore>/data/ossec/queue</ignore>
<ignore>/data/ossec/logs</ignore>
<ignore>/data/ossec/stats</ignore>
<ignore>/data/ossec/var</ignore>
Thank you,
--
finid
--
---
You received this message because you are subscribed to the Google Groups "ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
