I'm very interesting in this also. I know we can disable RIDS checking by setting:
# Verify msg id (set to 0 to disable it) remoted.verify_msg_id=0 within: local_internal_options.conf ...but I'm unlcear if the clients still check RIDS values from the server. On Tuesday, August 25, 2015 at 5:04:08 PM UTC-7, Winn Johnston wrote: > > I would like to talk about what it takes to keep the RIDS in sync. > Disabling this is not an option for us. We have multiple managers, some in > the network, some outside in the DMZ. I need a way to sync the RIDS so we > stop getting the duplicate key error messages. > > Any ideas? How have people in the past addressed this issue? > > Thanks > -winn > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
