[ossec-list] syscheck on agent - space? Missing something?
Just wondering if I am missing something. I have an agent that has used too much space for syscheck changes. I want to re-init with new rules. If I run syscheck_control with -u it says it will INIT the database, but the "old" stuff is still there. So I have to get on every system to clear the old junk and wasted space? Am I missing something here? thanks -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
Re: [ossec-list] syscheck on agent - space? Missing something?
On Mon, Mar 4, 2013 at 12:39 PM, Kat wrote: > Just wondering if I am missing something. I have an agent that has used too > much space for syscheck changes. I want to re-init with new rules. If I run > syscheck_control with -u it says it will INIT the database, but the "old" > stuff is still there. So I have to get on every system to clear the old junk > and wasted space? Am I missing something here? > > thanks > I think you'll just have to stop the processes and clear the files manually. > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
Re: [ossec-list] syscheck on agent - space? Missing something?
'syscheck_control -u ' delete the syscheck history database file for this agent on OSSEC server. It's a way to reduce unwanted alerts, say, after the agent machine was patched. It does not delete anything on the agent machine. On Tuesday, March 5, 2013 3:50:10 PM UTC-8, dan (ddpbsd) wrote: > > On Mon, Mar 4, 2013 at 12:39 PM, Kat > > wrote: > > Just wondering if I am missing something. I have an agent that has used > too > > much space for syscheck changes. I want to re-init with new rules. If I > run > > syscheck_control with -u it says it will INIT the database, but the > "old" > > stuff is still there. So I have to get on every system to clear the old > junk > > and wasted space? Am I missing something here? > > > > thanks > > > > I think you'll just have to stop the processes and clear the files > manually. > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to ossec-list+...@googlegroups.com . > > For more options, visit https://groups.google.com/groups/opt_out. > > > > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
