I personally use it mostly on very busy servers to limit the amount of events being sent by the agent to the manager.
Say a very busy web server that generates thousands of logs per second. Instead of sending all events centrally, I use the hybrid mode to do the initial analysis locally and only send the real alerts centrally (which is just a few per minute). thanks, On Thu, Feb 25, 2016 at 1:33 PM, Manoveg Saxena <[email protected]> wrote: > Hi, > > I am not able to understand when should I use hybrid mode. > > I have one server and 4 agents. > My server also have many applications and a web server which I want to > monitor along with that web servers and other applications on agents. > Therefore should I go for > 1) hybrid on server and agent on other servers > 2) or server and agent setup > > Thanks, > Manoveg > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
