On Wed, Jun 8, 2016 at 12:48 PM, Abdulvehhab Agin <abdulveh...@gmail.com> wrote: > Hi, > > I am looking for optimization sending windows events log. My systems > generate too much windows events. > > I analysed network traffic via wireshark, OSSEC generates too much open > connection and send logs (about 40 /peer second) > > > Thus, > > I don't want to connect ossec server for per event. Is there any > configuration to send logs via together (For Ex: Per 5 MB or 100 events -> > send logs)? >
There aren't any configurations to batch send logs or anything. > > I am found in internal_options.conf > monitord.day_wait=10 but it is not affect my ossec agent? > monitord does not run on agents. > > > > Best Regards > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
