Hi,
I have not found an answer to this issue, and I guess I'm not alone in this
case...
How do not scan an NFS mount point?
All my ossec agents scan all the disk, included nfs volumes.
For example, /home/data is my NFS volume and the ossec.conf is by default :
<!-- Directories to check (perform all possible verifications) -->
<directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
<directories check_all="yes">/bin,/sbin</directories>
I added an ignore directive as below but syscheckd still scan the directory.
<ignore>/home/data</ignore>
This impact my NFS server with high load read.
Do you have a solution to exclude a directory?
Thomas
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
