On Mon, Dec 8, 2014 at 7:17 AM, horst knete <[email protected]> wrote: > Hey guys, > > we are having an OSSEC server installation on debian with about 210 Windows > and Linux Ossec-Clients in our network. > > Regarding to syscheck we have literally have the default settings of ossec > that includes a big part of the windows registry and windows directory as > well as most linux directories and this check is executed every 10 hours. > > Now looking at our /var/ossec/queue/syscheck queue directory at the server, > this folder has an size of 5.4 GB and contains 2 "files" for almost every > ossec-client. >
Those are actually files. > I really wonder why this folder grows that big, cause it should only be the > queue if our server isnt able to perform the checks at the given time due to > lacking cpu/ram/network ressources. > Those files grow because there are changes on the systems they represent. Those are the syscheck database files. If you need them shrunk, you'll have to clear the databases. I don't know what the rest of that means though (the cpu/ram/network stuff). > Because none of these lacks are given i´d like to know how i can decrease > the size of this queue. > > Thx for response > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
