On Mon, Apr 20, 2015 at 12:04 PM, sandeep ganti <[email protected]> wrote: > Hello All, > > Can anyone let me know, what would be the maximum count for the number of > agents that can be added to a single OSSEC server. We have 2 OSSEC servers > in our environment and as of now we were able to add 6000 agents on each of > them and all of them seems to be working fine > > But at sometimes, if we run a status check for the number of agents that are > Active from the server, we just notice the count as 1 which means the rest > approx 5999 doesnt work. At this time if we restart the OSSEC process on the > server and run a status check later we see them as Active. It is fine if it > happens one or twice a day but the agents are getting dropped off more > regularly, The ossec.log on the server doesnt seem to be reporting any > errors. > > I knew there is something wrong on the OSSEC on the server side but keeps me > wondering where do i start to resolve this. Any help on this one is much > appreciated. Thank you very much. >
I'd start by looking at the system's utilization. See where the bottlenecks are. Also, try to figure out why the agents are disconnecting. Peeking at the ossec.log files on the agents and manager might be helpful. > > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
