ossec.conf scan time

Customer support forums for Atomic Protector (formerly Atomic Secured Linux). There is no such thing as a bad question here as long as it pertains to using Atomic Protector. Newbies feel free to get help getting started or asking questions that may be obvious. Regular users are asked to be gentle. :-)
DarkF@der
Forum Regular
Forum Regular
Posts: 313
Joined: Thu May 07, 2009 12:46 pm

ossec.conf scan time

Unread post by DarkF@der »

Hello,

I have multiple VPS running on a node with ASL. the ossec.conf tells <frequency>86400</frequency> scantime when ossec-syscheck will scan.
But it will hit all the VPS on the same time....., the disks are running bad because on all syscheck hitting the same time.

Now i can edit the ossec. conf on every machine and tell them the time <scan_time>00:05</scan_time>, but when asl -s -f will be run it's all gone!
And the default setting is again <frequency>86400</frequency>!!!

if i look in /var/asl/data/templates/template-ossec-server.conf i can't find anyting about frequency>86400</frequency>.

How the make <scan_time> permanent for the machines? to avoid hitting the disks at the same time?

Thnx in advanced
DarkF@der
Forum Regular
Forum Regular
Posts: 313
Joined: Thu May 07, 2009 12:46 pm

Re: ossec.conf scan time

Unread post by DarkF@der »

Nobody?? :oops:
jgodwin
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 39
Joined: Mon Sep 14, 2009 12:15 pm

Re: ossec.conf scan time

Unread post by jgodwin »

You may set this in ASL Web in the options tab of the File Integrity window.

Files in /var/asl/data should not be manipulated.
Post Reply