Hi As per my ossec default configuration, my syscheck is scheduled to run after every 6 hours.The directories to be checked are those that come specified in default conf file.I have seen whenever the syscheckd daemon runs on my server,it causes load on server.Can i tune this to prevent load from shooting up on my server?
Second thing if i set the frequency to run syscheck after every 12 hours so that syscheck runs only twice in a day, one at 12pm and another at 12am.But believ if my ossec server gets restarted at any point of time it will run syscheck after 12 hours counting from the instant my ossec server got restarted.This again can result in problem as my syscheck may get executed during peak hours. Please help. -- Regards Love Wadhwa Certified Ethical Hacker RedHat Certified Engg.
