Hmm -- I re-use IDs all the time. Did it when I had 30,000+ agents, and now with only 10,000. You just have to delete the key (I don't like that they are commented out) and make sure you remove the rids agent files in /var/ossec/queue/ossec/rids - find the number of the agent you removed and remove that file. Then you are free to re-use agent IDs all the time.
Cheers Kat On Thursday, July 28, 2016 at 2:03:34 PM UTC-5, Chanti Naani wrote: > > Hi, > We have a pretty decent implementation of the ossec with max clients set > to 3000. > So far we have generated close to 2900 client keys with in the past 1 > year. > But at the same time , a lot of people moved out and almost 500 endpoints > are not in use. > > If we delete those 500 endpoints (using /var/ossec/bin/manage_agents -r > $id) , will we be able to add 500 new clients to the ossec server? > without re-compiling the ossec authd server with increased set MAX_AGENTS) > > we are running: > > OSSEC HIDS v2.8 > > Thanks. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
