Hi Jon, these settings belong to arriving messages management. When agents delivery messages to the manager, Remoted decrypts, decompress and checks the counter from every message.
OSSEC saves the counters on files at /var/ossec/queue/rids in order to reload them when the manager is restarted, but it doesn't do it for every message, but each "*recv_counter_flush*". So, by default, OSSEC saves the counters every 128 messages. The "*comp_average_printout*" setting is used to print statistics about compression on the OSSEC log, so every 19.999 messages OSSEC will print the total size of compressed and uncompressed data, as well as compression rate. Hope it helps. Victor. On Tuesday, October 11, 2016 at 9:01:53 PM UTC+2, Jon Goodgion wrote: > > I would be super grateful if someone could explain what the > *remoted.recv_counter_flush* and *remoted.comp_average_printout *options > signify in the internal_options.conf file. > > By default they are set to 128 and 19999 respectively. How will it affect > the system if I raise or lower these values? > > I appreciate your help! > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.