Hey guys, we are having an OSSEC server installation on debian with about 210 Windows and Linux Ossec-Clients in our network.
Regarding to syscheck we have literally have the default settings of ossec that includes a big part of the windows registry and windows directory as well as most linux directories and this check is executed every 10 hours. Now looking at our /var/ossec/queue/syscheck queue directory at the server, this folder has an size of 5.4 GB and contains 2 "files" for almost every ossec-client. I really wonder why this folder grows that big, cause it should only be the queue if our server isnt able to perform the checks at the given time due to lacking cpu/ram/network ressources. Because none of these lacks are given i´d like to know how i can decrease the size of this queue. Thx for response -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
