Hi,
I am looking for optimization sending windows events log. My systems
generate too much windows events.
I analysed network traffic via wireshark, OSSEC generates too much open
connection and send logs (about 40 /peer second)
Thus,
I don't want to connect ossec server for per event. Is there any
configuration to send logs via together (For Ex: Per 5 MB or 100 events ->
send logs)?
I am found in internal_options.conf
monitord.day_wait=10 but it is not affect my ossec agent?
Best Regards
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
