Try using this script: https://github.com/ossec/ossec-hids/blob/master/contrib/ossec-eps.sh
Another option is to enable logall option and count events in archive.log (you can count all events in a day and then do the math). Regarding resources it depends on how much data OSSEC manager/agents will be processing. There is no official benchmarks so I would recommend to run it in a pre-production environment first. I hope it helps On Wed, May 11, 2016 at 12:57 PM, Abdulvehhab Agin <[email protected]> wrote: > Hello, > > > Is there a way to measure OSSEC agent EPS count; not alarm? > > And Please let me know us of system resources. > > > Thanks > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
