Re: [ossec-list] syscheck on agent - space? Missing something?
'syscheck_control -u agent_id' delete the syscheck history database file for this agent on OSSEC server. It's a way to reduce unwanted alerts, say, after the agent machine was patched. It does not delete anything on the agent machine. On Tuesday, March 5, 2013 3:50:10 PM UTC-8, dan (ddpbsd) wrote: On Mon, Mar 4, 2013 at 12:39 PM, Kat uncom...@gmail.com javascript: wrote: Just wondering if I am missing something. I have an agent that has used too much space for syscheck changes. I want to re-init with new rules. If I run syscheck_control with -u it says it will INIT the database, but the old stuff is still there. So I have to get on every system to clear the old junk and wasted space? Am I missing something here? thanks I think you'll just have to stop the processes and clear the files manually. -- --- You received this message because you are subscribed to the Google Groups ossec-list group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+...@googlegroups.com javascript:. For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups ossec-list group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
Re: [ossec-list] syscheck on agent - space? Missing something?
On Mon, Mar 4, 2013 at 12:39 PM, Kat uncommon...@gmail.com wrote: Just wondering if I am missing something. I have an agent that has used too much space for syscheck changes. I want to re-init with new rules. If I run syscheck_control with -u it says it will INIT the database, but the old stuff is still there. So I have to get on every system to clear the old junk and wasted space? Am I missing something here? thanks I think you'll just have to stop the processes and clear the files manually. -- --- You received this message because you are subscribed to the Google Groups ossec-list group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups ossec-list group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
[ossec-list] syscheck on agent - space? Missing something?
Just wondering if I am missing something. I have an agent that has used too much space for syscheck changes. I want to re-init with new rules. If I run syscheck_control with -u it says it will INIT the database, but the old stuff is still there. So I have to get on every system to clear the old junk and wasted space? Am I missing something here? thanks -- --- You received this message because you are subscribed to the Google Groups ossec-list group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
