these settings belong to arriving messages management. When agents delivery
messages to the manager, Remoted decrypts, decompress and checks the
counter from every message.
OSSEC saves the counters on files at /var/ossec/queue/rids in order to
reload them when the manager is restarted, but it doesn't do it for every
message, but each "*recv_counter_flush*". So, by default, OSSEC saves the
counters every 128 messages.
The "*comp_average_printout*" setting is used to print statistics about
compression on the OSSEC log, so every 19.999 messages OSSEC will print the
total size of compressed and uncompressed data, as well as compression rate.
Hope it helps.
On Tuesday, October 11, 2016 at 9:01:53 PM UTC+2, Jon Goodgion wrote:
> I would be super grateful if someone could explain what the
> *remoted.recv_counter_flush* and *remoted.comp_average_printout *options
> signify in the internal_options.conf file.
> By default they are set to 128 and 19999 respectively. How will it affect
> the system if I raise or lower these values?
> I appreciate your help!
You received this message because you are subscribed to the Google Groups
To unsubscribe from this group and stop receiving emails from it, send an email
For more options, visit https://groups.google.com/d/optout.