On Tue, Jun 9, 2015 at 9:59 AM, Molle Thomas <[email protected]> wrote: > Hi, > > > > I have not found an answer to this issue, and I guess I'm not alone in this > case... > > > > How do not scan an NFS mount point? > > > > All my ossec agents scan all the disk, included nfs volumes. > > > > For example, /home/data is my NFS volume and the ossec.conf is by default : > > > > <!-- Directories to check (perform all possible verifications) --> > > <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories> > > <directories check_all="yes">/bin,/sbin</directories> > > > > I added an ignore directive as below but syscheckd still scan the directory. > > <ignore>/home/data</ignore> > > > > This impact my NFS server with high load read. > > Do you have a solution to exclude a directory? >
In 2.9 we have skip_nfs http://ossec-docs.readthedocs.org/en/latest/syntax/head_ossec_config.rootcheck.html?highlight=nfs#element-skip_nfs > > > Thomas > > > > > > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
