Kat,
Did you just work around the issue by having many ossec instances? Or did
you somehow get beyond the CPU issue?
Thanks for your help!
Brian
On Thursday, December 8, 2011 8:45:42 AM UTC-8, Kat wrote:
Yep -- sending 1800 agents to a single server so it has a lot to
analyze. I am finding that this causes many of the agents to show
disconnected because they can't get to the server while it is
processing very busy nodes. So rather than throw additional servers at
it, I have all the cores, but I am maxing out a single core and the
others just sit there. :-(
On Dec 8, 9:09 am, dan (ddp) ddp...@gmail.com wrote:
OSSEC isn't really built for multiple cores. Are you pushing enough
data through it to consume a whole core? How many eps?
