Might have to inspect set max agents? I don¹t know the performance limits, but some tweaks are listed here
http://ossec-docs.readthedocs.org/en/latest/faq/ossec.html#can-an-ossec-man ager-have-more-than-256-agents On 4/20/15, 9:07 AM, "dan (ddp)" <[email protected]> wrote: >On Mon, Apr 20, 2015 at 12:04 PM, sandeep ganti ><[email protected]> wrote: >> Hello All, >> >> Can anyone let me know, what would be the maximum count for the number >>of >> agents that can be added to a single OSSEC server. We have 2 OSSEC >>servers >> in our environment and as of now we were able to add 6000 agents on >>each of >> them and all of them seems to be working fine >> >> But at sometimes, if we run a status check for the number of agents >>that are >> Active from the server, we just notice the count as 1 which means the >>rest >> approx 5999 doesnt work. At this time if we restart the OSSEC process >>on the >> server and run a status check later we see them as Active. It is fine >>if it >> happens one or twice a day but the agents are getting dropped off more >> regularly, The ossec.log on the server doesnt seem to be reporting any >> errors. >> >> I knew there is something wrong on the OSSEC on the server side but >>keeps me >> wondering where do i start to resolve this. Any help on this one is much >> appreciated. Thank you very much. >> > >I'd start by looking at the system's utilization. See where the >bottlenecks are. Also, try to figure out why the agents are >disconnecting. Peeking at the ossec.log files on the agents and >manager might be helpful. > >> >> >> -- >> >> --- >> You received this message because you are subscribed to the Google >>Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send >>an >> email to [email protected]. >> For more options, visit >>http://cp.mcafee.com/d/1jWVIg6zqb2pEVvosKNsTsSCyCqenSjhPssUrjhjd7bX9EVjju >>dFEFCzBZAQsT73zqdNPybbytNNJqxfoqXVYMla4_yHW4JU6CVgDYlvgBL0QSYOMC-O-_R-pvv >>KY-eWZOWrbb_3AnDCkPhPORQr8FGEELYG7DR8OJMddECQPt-jLuZXTLuVKVIDeqR4IMz6HqRe >>8RGhf_BYgOGQWJPdRFjX5PVkC04x2N12bYqb5qcl848699Qr5yF4m-cFLICd1h6Ji9_AoRrmF >>OVJNdxwS2_id41FrHiDSbDOFcQKCy0g8_2pEwfAHapEwF8kYSOOr_XSd. > >-- > >--- >You received this message because you are subscribed to the Google Groups >"ossec-list" group. >To unsubscribe from this group and stop receiving emails from it, send an >email to [email protected]. >For more options, visit >http://cp.mcafee.com/d/5fHCN8gdEI9CzBZxOX5PtPqqapEVvpd7dNPxJd5cQsLICzBddUS >CyCqenSjhPssedET7e8IK9T76RG4ZxHLDP1kEj-aLEiTwqrB2vNlZ2mY3jrPb2rXbX_nVBZ-XP >UXHTbFIILYehuupjd7fbnhIyCGyy_OEuvkzaT0QSCrjdTVeZXTLuZXCXCOsVHkiP2cqJHkUzmF >4_-nN3aHjGTcTmBfInfBio0i4b448LNEIlENkwgwoADhImaAhrUOC-OoQ54qR8D-hzlJqDbCT4 >S63obZ8Qg6BKJavoKvaAPiWq810zY9Cy0-iIFCy2AxjPrb9I5YoEsxI. Intermedia 3310 146th Place SE Bellevue, Washington 98007 www.intermedia.net<http://www.intermedia.net/> • Follow us on Twitter<http://twitter.com/intermedia_net> About Intermedia Intermedia is a one-stop shop for cloud business applications. For 60,000+ business customers and 5,000+ active partners, our Office in the Cloud™ integrates email, voice, file sync and share, security and many other essential IT services—supported by our Worry-free Experience™. Learn more at Intermedia.net<http://intermedia.net> or read our latest report: Rogue Access: The Ex-Employee Menace<http://www.intermedia.net/Reports/RogueAccess?utm_source=social&utm_medium=CorporateEmailSig&utm_content=Report&utm_campaign=SSAppID>. ________________________________ This message is intended only for the person(s) to which it is addressed and may contain Intermedia.net. Inc. privileged, confidential and/or proprietary information. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Any disclosure, copying, distribution, or the taking of any action concerning the contents of this message and any attachment(s) by anyone other than the named recipient(s) is strictly prohibited. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
