How much ram have you assigned to the system? Are you running under any virtual environment or on base machine?
Are you collecting all logs via rsyslog or only specific logs? In my experiance, ossec consumes a lot of cache memory which is released at every midnight. Check cache memory metrics if possible. On Tuesday, May 29, 2018 at 11:21:56 PM UTC+5:30, Cooper wrote: > > Hey all, > > One of my ossec-remoted processes is eating up a ton of RAM, to the point > that it eventually crashes. Is there anyway to see what's going on or why > it's doing that? I have around 1800 agents connected. > -- _____________________________________________________________ The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. It may contain confidential or legally privileged information. If you are not the intended recipient you are hereby notified that any disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by responding to this email and then delete it from your system. The firm is neither liable for the proper and complete transmission of the information contained in this communication nor for any delay in its receipt. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
