ossec-syscheckd

Customer support forums for Atomic Protector (formerly Atomic Secured Linux). There is no such thing as a bad question here as long as it pertains to using Atomic Protector. Newbies feel free to get help getting started or asking questions that may be obvious. Regular users are asked to be gentle. :-)
DarkF@der
Forum Regular
Forum Regular
Posts: 313
Joined: Thu May 07, 2009 12:46 pm

ossec-syscheckd

Unread post by DarkF@der »

I don't know if i'm posting this a the right place.... but i try... :)

We love ASL :) We have a large machine with multiple VM's on every VM ASL is installed and it's working perfectly the only thing is on all the machine ossec-syscheck wil start scanning at the same time.

So the disks will be give higher IO because off the scans on every machine at the same time.
Is there a anyway to change that? That they not run al together to still have a good performance?

Thanx in advanced.
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Re: ossec-syscheckd

Unread post by scott »

OSSEC does support setting fixed times for running syscheck, so thats a partial solution. Eventually we plan on implementing fanotify in syscheck so that the scan portion of syscheck isnt needed any more.
DarkF@der
Forum Regular
Forum Regular
Posts: 313
Joined: Thu May 07, 2009 12:46 pm

Re: ossec-syscheckd

Unread post by DarkF@der »

Hello scot thank you for posting can you tell where or how to set that for now?
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Re: ossec-syscheckd

Unread post by scott »

Post Reply