How many folders/files are you monitoring for changes? On Friday, May 10, 2013 1:32:33 AM UTC-7, Winni Neessen wrote: > > Hi, > > I am running OSSEC 2.7 on FreeBSD 8.4. Recently I received a kernel > warning, that maxfiles was exceeded. > I was wondering how this could be, as kern.maxfiles was configured to 32k. > A run of "lsof" quickly showed that > OSSEC was the bad guy. 30k files were currently open through OSSEC. After > a restart the count was back to > 1k. A week later I can see that the kern.openfiles is again at 18k and > constantly growing. 16k are again used > by OSSEC. > > My question... is this normal behaviour by OSSEC, so that I need to adjust > my kern.maxfiles settings? Or could > this be some kind of misbehaviour? > > Any advice is greatly appreciated. > > > Thanks > Winni >
-- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
