[ossec-dev] Re: problem with MAX_AGENTS

["Daniel Cid" <dcid@xxxxxxxxx>]

Hi Jeremy,

Thanks for the report. It's nice to see that ossec is handling this large number
of agents. One think you can change is the maximum number of events stored
in memory for correlation. By default it is 1024, but for your large
install you can
increase it to 5096 or something larger. Just set the "memory_size" option in
the "global" section to the value you want. Most of the times I increase it to
5096 :)

Btw, how many events and alerts per second do you have? (Analysisd store
them hourly)... Just curious..

Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net

On 11/1/06, Jeremy Hanmer <jeremy@xxxxxxxxxxxxxxx> wrote:
> On Oct 30, 2006, at 5:07 PM, Daniel Cid wrote:
>
> >
> > Hi Jeremy,
> >
> >
> > *btw, let us know how ossec behaves with that large number of agents.
> > The maximum
> > I tested with was 74 agents.
>
> I've had everything running since Sunday with all 420 agents and
> everything's looking good.  As far as performance goes, the box is a
> dual-core Opteron 165 with 2GB of RAM.  During the busiest time of
> the day, ossec-analysisd averages about 50% CPU with less than 2MB of
> RAM used and ossec-remoted averages about 5% CPU with about 3MB of
> RAM usage.
>
>
>
>
> > Thanks,
> >
> > --
> > Daniel B. Cid
> > dcid ( at ) ossec.net
> >
> > On 10/30/06, Jeremy Hanmer <jeremy@xxxxxxxxxxxxxxx> wrote:
> >>
> >> I've got a fairly large ossec installation that I've just set up
> >> (currently 420 agents with 1 central server) and I hit a problem with
> >> MAX_AGENTS.  With more than 256 agents, ossec-remoted segfaults.  I
> >> had to dig through the code to figure out what to raise since nothing
> >> gets logged when it crashes.  I tried to add some error handling, but
> >> it looks like a lot of places would need checks and I'm not quite
> >> comfortable with that just yet.
> >>