[ossec-dev] Re: problem with MAX_AGENTS

[Jeremy Hanmer <jeremy@xxxxxxxxxxxxxxx>]

On Oct 30, 2006, at 5:07 PM, Daniel Cid wrote:

> Hi Jeremy,
>
>
> *btw, let us know how ossec behaves with that large number of agents.
> The maximum
> I tested with was 74 agents.

I've had everything running since Sunday with all 420 agents and  
everything's looking good.  As far as performance goes, the box is a  
dual-core Opteron 165 with 2GB of RAM.  During the busiest time of  
the day, ossec-analysisd averages about 50% CPU with less than 2MB of  
RAM used and ossec-remoted averages about 5% CPU with about 3MB of  
RAM usage.




> Thanks,
>
> --
> Daniel B. Cid
> dcid ( at ) ossec.net
>
> On 10/30/06, Jeremy Hanmer <jeremy@xxxxxxxxxxxxxxx> wrote:
> > I've got a fairly large ossec installation that I've just set up
> > (currently 420 agents with 1 central server) and I hit a problem with
> > MAX_AGENTS.  With more than 256 agents, ossec-remoted segfaults.  I
> > had to dig through the code to figure out what to raise since nothing
> > gets logged when it crashes.  I tried to add some error handling, but
> > it looks like a lot of places would need checks and I'm not quite
> > comfortable with that just yet.