Hi Jon,

these settings belong to arriving messages management. When agents delivery 
messages to the manager, Remoted decrypts, decompress and checks the 
counter from every message.

OSSEC saves the counters on files at /var/ossec/queue/rids in order to 
reload them when the manager is restarted, but it doesn't do it for every 
message, but each "*recv_counter_flush*". So, by default, OSSEC saves the 
counters every 128 messages.

The "*comp_average_printout*" setting is used to print statistics about 
compression on the OSSEC log, so every 19.999 messages OSSEC will print the 
total size of compressed and uncompressed data, as well as compression rate.

Hope it helps.

On Tuesday, October 11, 2016 at 9:01:53 PM UTC+2, Jon Goodgion wrote:
> I would be super grateful if someone could explain what the 
> *remoted.recv_counter_flush* and *remoted.comp_average_printout *options 
> signify in the internal_options.conf file.
> By default they are set to 128 and 19999 respectively. How will it affect 
> the system if I raise or lower these values?
> I appreciate your help!


You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Reply via email to