OSSEC agent limit modification after server install

342 views
Skip to first unread message

Nikki Sridhar

unread,
Jan 12, 2017, 3:22:50 PM1/12/17
to ossec-list
Is there a command that can be run to change the max agents per manager? 

The OSSEC server has already been installed so I cannot find a way to run the following:

Can an OSSEC manager have more than 256 agents?
By default OSSEC limits the number of agents to 256 per manager. This limitation is set in the code, but
can be modified at compile time. Depending on the event load, a manager running on modern hardware
can handle many more agents. Some users have more than 1000 agents on a single manager. To change
the maximum number of agents, cd into the src directory and run the following command:
make setmaxagents

Any help with this much appreciated! 


Chris Warren

unread,
Jan 12, 2017, 3:41:56 PM1/12/17
to ossec...@googlegroups.com






----- Original Message -----
> Is there a command that can be run to change the max agents per manager?
>
> The OSSEC server has already been installed so I cannot find a way to run
> the following:
>
> *Can an OSSEC manager have more than 256 agents?*
> *By default OSSEC limits the number of agents to 256 per manager. This
> limitation is set in the code, but*
> *can be modified at compile time. Depending on the event load, a manager
> running on modern hardware*
> *can handle many more agents. Some users have more than 1000 agents on a
> single manager. To change*
> *the maximum number of agents, cd into the src directory and run the
> following command:*
> *make setmaxagents*
>
> Any help with this much appreciated!

After 'make setmaxagents' you can simply run install.sh again to update the binaries.

Choose 'y' when you see:
You already have OSSEC installed. Do you want to update it? (y/n)

Nikki S

unread,
Jan 12, 2017, 3:46:26 PM1/12/17
to ossec-list
Thank you Chris! 

Nikki S

unread,
Jan 12, 2017, 4:07:37 PM1/12/17
to ossec-list
The server was initially installed from the installation package so I guess I need to download the entire package with src and configure it again? 


On Thursday, January 12, 2017 at 3:22:50 PM UTC-5, Nikki S wrote:
Reply all
Reply to author
Forward
0 new messages