[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ossec-list
Subject:    [ossec-list] Syscheckd inotify limit
From:       Franz Nemeth <mind.pl0ke () gmail ! com>
Date:       2013-09-23 11:29:12
Message-ID: d87e5084-cc6b-4a81-a20b-453a868d8a70 () googlegroups ! com
[Download RAW message or body]

Hello,

We recently encoutered a problem with the syscheck daemon and inotify:

We are monitoring quite a large number of files in realtime and the 
inotify_user_watches is still set on 8192 files. This resulted in several 
commands not working anymore (tailf for instance).
Is there a way to limit the number of realtime watched files although the 
actual number of files is greater than the inotify_user_watches limit?
If not could you please mention in your documentation that admins should 
check first how many files they are actually monitoring in realtime and 
that the standard limit will not be sufficient (e. g. find /var/www/ -type 
f | wc -l).

Thanks in advance

Franz Nemeth

-- 

--- 
You received this message because you are subscribed to the Google Groups \
"ossec-list" group. To unsubscribe from this group and stop receiving emails from it, \
send an email to ossec-list+unsubscribe@googlegroups.com. For more options, visit \
https://groups.google.com/groups/opt_out.


[Attachment #3 (text/html)]

<div dir="ltr">Hello,<br><br>We recently encoutered a problem with the syscheck \
daemon and inotify:<br><br>We are monitoring quite a large number of files in \
realtime and the inotify_user_watches is still set on 8192 files. This resulted in \
several commands not working anymore (tailf for instance).<br>Is there a way to limit \
the number of realtime watched files although the actual number of files is greater \
than the inotify_user_watches limit?<br>If not could you please mention in your \
documentation that admins should check first how many files they are actually \
monitoring in realtime and that the standard limit will not be sufficient (e. g. find \
/var/www/ -type f | wc -l).<br><br>Thanks in advance<br><br>Franz Nemeth<br></div>

<p></p>

-- <br />
&nbsp;<br />
--- <br />
You received this message because you are subscribed to the Google Groups \
&quot;ossec-list&quot; group.<br /> To unsubscribe from this group and stop receiving \
emails from it, send an email to ossec-list+unsubscribe@googlegroups.com.<br /> For \
more options, visit <a \
href="https://groups.google.com/groups/opt_out">https://groups.google.com/groups/opt_out</a>.<br \
/>



[prev in list] [next in list] [prev in thread] [next in thread]