Re: [ossec-list] Maximum Number of Agents Allowed
Hi Patrick, unfortunately there is no way to do this, since the maximum agents parameter is used to create some static arrays into the code. This makes necessary to re-compile and install the binaries. Best regards. On Fri, Jan 20, 2017 at 1:51 PM, wrote: > Is there a way to set the max number of agents without recompiling the > installer? > > On Saturday, August 20, 2011 at 11:01:06 PM UTC-4, Michael Starks wrote: >> >> On 08/18/2011 07:52 AM, Swartz, Patrick H wrote: >> > That is the default maximum, however it is modifiable by going into the >> > /src directory (of the install package) and running "make setmaxagents", >> > this will prompt you asking for a new maximum value. >> > You will then need to recompile to take advantage of the new value. >> > We currently use 4096 (with close to 2000 active agents) with no issues. >> > >> > Patrick Swartz >> >> I would also recommend some OS tuning with that many agents: >> http://www.immutablesecurity.com/index.php/2010/10/20/2woo-tips-tricks/ >> > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- Victor M. Fernandez-Castro IT Security Engineer Wazuh Inc. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [ossec-list] Maximum Number of Agents Allowed
Is there a way to set the max number of agents without recompiling the installer? On Saturday, August 20, 2011 at 11:01:06 PM UTC-4, Michael Starks wrote: > > On 08/18/2011 07:52 AM, Swartz, Patrick H wrote: > > That is the default maximum, however it is modifiable by going into the > > /src directory (of the install package) and running "make setmaxagents", > > this will prompt you asking for a new maximum value. > > You will then need to recompile to take advantage of the new value. > > We currently use 4096 (with close to 2000 active agents) with no issues. > > > > Patrick Swartz > > I would also recommend some OS tuning with that many agents: > http://www.immutablesecurity.com/index.php/2010/10/20/2woo-tips-tricks/ > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [ossec-list] Maximum number of agents allowed:
The only issues you have to keep in mind are the maxagents - pretty simple - but there is another hidden setting in the client keys creation that is in the code. Set to 4000 by default. Have to edit that and set it to whatever. I fixed the makefile to do it when you change the setmaxagents. The value is -- in validate.c in ~/src/addagent folder. in the Makeall you will find this code: # Increasing maximum number of agents if [ "X$1" = "Xsetmaxagents" ]; then echo -n "Specify maximum number of agents: "; read AGMAX echo "HEXTRA=-DMAX_AGENTS=$AGMAX" >> ./Config.OS echo "Maximum number of agents set to $AGMAX." exit 0; fi and I updated mine to change the value in validate.c as well. # Increasing maximum number of agents if [ "X$1" = "Xsetmaxagents" ]; then echo -n "Specify maximum number of agents: "; read AGMAX echo "HEXTRA=-DMAX_AGENTS=$AGMAX" >> ./Config.OS sed -i 's/if\(i \>\= 4000\)/if\(i >= $AGMAX\)/' addagent/validate.c echo "Maximum number of agents set to $AGMAX." exit 0; fi -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
Re: [ossec-list] Maximum number of agents allowed:
2013/2/28 Alexander Hartner : > Any option of achieving the same without a re-compile. Ideally we would like > to use the binary distribution to be able to pull new versions via the rpm > repository. Installing from source would require us to manage the version of > OSSEC server manually. > > -- Well, currently number of agents is hardcoded into ossec sources. -- Eero -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
Re: [ossec-list] Maximum number of agents allowed:
Any option of achieving the same without a re-compile. Ideally we would like to use the binary distribution to be able to pull new versions via the rpm repository. Installing from source would require us to manage the version of OSSEC server manually. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
Re: [ossec-list] Maximum Number of Agents Allowed
On 08/18/2011 07:52 AM, Swartz, Patrick H wrote: That is the default maximum, however it is modifiable by going into the /src directory (of the install package) and running "make setmaxagents", this will prompt you asking for a new maximum value. You will then need to recompile to take advantage of the new value. We currently use 4096 (with close to 2000 active agents) with no issues. Patrick Swartz I would also recommend some OS tuning with that many agents: http://www.immutablesecurity.com/index.php/2010/10/20/2woo-tips-tricks/
RE: [ossec-list] Maximum Number of Agents Allowed
That is the default maximum, however it is modifiable by going into the /src directory (of the install package) and running "make setmaxagents", this will prompt you asking for a new maximum value. You will then need to recompile to take advantage of the new value. We currently use 4096 (with close to 2000 active agents) with no issues. Patrick Swartz -Original Message- From: ossec-list@googlegroups.com [mailto:ossec-list@googlegroups.com] On Behalf Of PJG Sent: Thursday, August 18, 2011 4:49 AM To: ossec-list Subject: [ossec-list] Maxiumum Number of Agents Allowed Dear All, We are planning on ramping up our OSSEC deployment. There's a warning which is seen in the log files which states: INFO: Maximum number of agents allowed: '256'. Does anyone know if this is an actual limit, or simply recommended? Also if it is breached, does this have any impact on the service? If so, is there anyway to increase this amount? Thanks Pip - The information in this message may be proprietary and/or confidential, and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify First Data immediately by replying to this message and deleting it from your computer.
