[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ossec-dev
Subject:    Re: [ossec-dev] MQ design
From:       Michael Starks <ossec-list () michaelstarks ! com>
Date:       2013-07-09 16:21:13
Message-ID: 3822bc6190f4f66c2e184952c832c838 () michaelstarks ! com
[Download RAW message or body]

On 09.07.2013 10:52, Brad Lhotsky wrote:
> I see a spike of UDP traffic at the time of the ossec syscheckd
> scans.  Its within the bounds of normal peak UDP traffic on our
> network.  As it runs off-peak, its not causing problems. 
> Introducing a splay into the syscheckd on the agents may alleviate
> this?   Make it configurable, so it can handle large installs. 
> Should be an easy enough fix.

I like the idea of a configurable random offset. Even a fifteen minute 
offset should have a noticeable positive impact with lots of agents. 
This is especially true if you use agent_control to restart all agents 
and syscheck is set to scan on start.

-- 

--- 
You received this message because you are subscribed to the Google Groups "ossec-dev" \
group. To unsubscribe from this group and stop receiving emails from it, send an \
email to ossec-dev+unsubscribe@googlegroups.com. For more options, visit \
https://groups.google.com/groups/opt_out.


[prev in list] [next in list] [prev in thread] [next in thread]