store | blogs | forums | twitter | facebook | wiki | downloads | support portal
Atomic Secure Linux
It is currently Tue Nov 24, 2020 1:55 pm

» Feed - Atomicorp

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 3 posts ] 
Author Message
 Post subject: OSSEC Appliance Max Agents
Unread postPosted: Fri Nov 13, 2020 7:40 am 
Offline
New Forum User
New Forum User

Joined: Fri Nov 13, 2020 5:12 am
Posts: 2
Location: Cologne
Hello,

how can i configure max agents in the Ossec Appliance?

Best Regards


Top
 Profile  
Reply with quote  
 Post subject: Re: OSSEC Appliance Max Agents
Unread postPosted: Sat Nov 14, 2020 10:01 am 
Offline
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin

Joined: Fri Oct 09, 2020 9:41 am
Posts: 3
By default OSSEC limits the number of agents to 256 per manager. This limitation is set in the code, but can be modified at compile time. Depending on the event load, a manager running on modern hardware can handle many more agents. Some users have more than 1000 agents on a single manager. To change the maximum number of agents, cd into the src directory and run the following command:

make setmaxagents

You should be prompted for the number of agents to allow.

One issue you may face after changing this setting is the number of files allowed to be open for a single user. The users ossec and ossecr both open at least 1 file (syscheck database and rids file) per agent. Raising this limit is operating system specific.

Some Linux distributions support a /etc/security/limits.conf. Set the limits to be at least a few files above what the max agents is set to.

ossec soft nofile 2048
ossec hard nofile 2048
ossecr soft nofile 2048
ossecr hard nofile 2048


Top
 Profile  
Reply with quote  
 Post subject: Re: OSSEC Appliance Max Agents
Unread postPosted: Mon Nov 16, 2020 4:52 am 
Offline
New Forum User
New Forum User

Joined: Fri Nov 13, 2020 5:12 am
Posts: 2
Location: Cologne
Hello cpenton,

thank you for the answer. But we use the Ossec Appliance, can i set the value in limits.conf or must be reinstall the ossec service?

thx for answer


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 3 posts ] 

» Feed - Atomicorp

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group