On Mon, Dec 1, 2014 at 4:33 AM, horst knete <[email protected]> wrote: > Hey guys, > > today we encountered a very strange problem regarding our OSSEC > installation. > > On the central OSSEC server, these messages appeared in the ossec.log: > > 2014/12/01 09:38:06 ossec-analysisd: Unable to open integrity file. Increase > MAX_AGENTS. > 2014/12/01 09:38:06 ossec-analysisd: Error handling integrity database. > 2014/12/01 09:38:08 ossec-analysisd: Unable to open integrity file. Increase > MAX_AGENTS. > 2014/12/01 09:38:08 ossec-analysisd: Error handling integrity database. > 2014/12/01 09:38:08 ossec-analysisd: Unable to open integrity file. Increase > MAX_AGENTS. > 2014/12/01 09:38:08 ossec-analysisd: Error handling integrity database. > > along with these messages one of the ossec clients started to send huge > amounts of data to the central server, using all bandwith avaiable. > > Given to the message we should increase the max_agents of Ossec. this seems > odd, because we actually have 215 active agents and 256 is the default > maximum of OSSEC. > > Anyone got any idea on this? >
Make sure you aren't hitting max open file or similar resource limits. > thanks > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
