[ossec-list] Re: OSSEC on embedded system ?

["Meir Michanie" <meirgotroot@xxxxxxxxx>]

if it could be possible to set ossec to work on a ring file, then a few megs should be enough.
With the current functionality you need to calculate the number of events per day that you will parse and log.
each event is 5 lines of text. my calculation is that every alert takes 300 bytes average, (log of 2MG / 7000 alerts)

On 11/3/06, Monteiro, Teresa <teresa.monteiro@xxxxxxxxxxx> wrote:

Thanks a lot you for your quick feedback, Daniel and Meir.

 

What would be the minimum amount of hard disk space you would advise ?

Cheers,
Teresa

---

From: ossec-list@xxxxxxxxxxxxxxxx [mailto:ossec-list@xxxxxxxxxxxxxxxx] On Behalf Of Meir Michanie
Sent: Thursday, November 02, 2006 10:32 AM
To: ossec-list@xxxxxxxxxxxxxxxx
Subject: [ossec-list] Re: OSSEC on embedded system ?

the only problem is hdd space.

On 11/1/06, Daniel Cid <daniel.cid@xxxxxxxxx> wrote:

Hi Teresa,

Ossec should work well on low-memory and low-cpu systems. I actually
have it running as a server (monitoring 4 agents) in a PII with only 64M of
memory without any problems. Anything higher than that will work fine...


hope it helps.

--
Daniel B. Cid
dcid ( at ) ossec.net

On 10/31/06, Monteiro, Teresa <teresa.monteiro@xxxxxxxxxxx > wrote:
>
>
>
> Hi.
> I am trying to find out whether I can install and run OSSEC on an embedded
> system. It is a PowerPC 400MHz, running Linux - also, what kind of memory
> requirements are there ?
>
> Thanks a lot!
> Cheers,
> Teresa
>
>