Not too many. But I think I found the issue. I was accidently monitoring a webserver temp. directory with couple of session files in it. I unmonitored that directory and now it seems fine.
On Tuesday, May 14, 2013 9:46:48 PM UTC+2, Kat wrote: > > How many folders/files are you monitoring for changes? > > On Friday, May 10, 2013 1:32:33 AM UTC-7, Winni Neessen wrote: >> >> Hi, >> >> I am running OSSEC 2.7 on FreeBSD 8.4. Recently I received a kernel >> warning, that maxfiles was exceeded. >> I was wondering how this could be, as kern.maxfiles was configured to >> 32k. A run of "lsof" quickly showed that >> OSSEC was the bad guy. 30k files were currently open through OSSEC. After >> a restart the count was back to >> 1k. A week later I can see that the kern.openfiles is again at 18k and >> constantly growing. 16k are again used >> by OSSEC. >> >> My question... is this normal behaviour by OSSEC, so that I need to >> adjust my kern.maxfiles settings? Or could >> this be some kind of misbehaviour? >> >> Any advice is greatly appreciated. >> >> >> Thanks >> Winni >> > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
