On Mon, 8 Dec 2014, Rick McClinton wrote:
David, Eero is right that disk space is relatively quite inexpensive these days; I think lots of us are more concerned with log retention against future audit needs than with disk usage. Anyway, it's pretty easy to set up cron scripts for log file cleanups.
disk space is cheap, but I have something else archiving the logs, I don't need to do it on the ossec box as well.
This just ends up causing additional I/O and eating additional cpu for no benefit.
To address your question, I don't think we have a STDIN; maybe you would be more interested to have OSSEC receive the syslog directly instead of "buffering" it through the regular syslogd.
the question is, do I trust the OSSEC implementation of syslog or the rsyslog implementation of syslog? :-) I know that rsyslog can keep up with several hundred thousand logs/sec (well past gig-E wire speed). I'd rather have rsyslog handling the full stream and only feed the portion that needs to go to OSSEC to the ossec process.
I'm coming from the point of view that I have a very large volume of logs and have farms of servers processing them, with different sets of servers for different types of work.
David Lang
