On Tue, Jun 9, 2015 at 9:59 AM, Molle Thomas <[email protected]> wrote:
> Hi,
>
>
>
> I have not found an answer to this issue, and I guess I'm not alone in this
> case...
>
>
>
> How do not scan an NFS mount point?
>
>
>
> All my ossec agents scan all the disk, included nfs volumes.
>
>
>
> For example, /home/data is my NFS volume and the ossec.conf is by default :
>
>
>
> <!-- Directories to check  (perform all possible verifications) -->
>
>     <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
>
>     <directories check_all="yes">/bin,/sbin</directories>
>
>
>
> I added an ignore directive as below but syscheckd still scan the directory.
>
> <ignore>/home/data</ignore>
>
>
>
> This impact my NFS server with high load read.
>
> Do you have a solution to exclude a directory?
>

In 2.9 we have skip_nfs
http://ossec-docs.readthedocs.org/en/latest/syntax/head_ossec_config.rootcheck.html?highlight=nfs#element-skip_nfs

>
>
> Thomas
>
>
>
>
>
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> For more options, visit https://groups.google.com/d/optout.

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Reply via email to