improving agentless polling frequancy

[Myke Iz]

Hi,

I want to reduce the frequency of the agentless polling for quicker performance on my manager (wazuh 3.2.0) but I cannot find clues for doing this.

It seems to me that the agentless process runs my agentless configuration in a sequential order (is this correct? - Is there any multithreading?).

I have 48 entries that do both ssh_integrity_check_linux and ssh_generic_diff tests.

A full cycle takes about an hour to complete. Therefore my minimum frequency can only be about an hour.

How can I increase the polling frequency to get quicker results?

Ideally, if I could get the polling down to 5 minutes:

<!-- Tell me if a file has changed -->
<agentless>
  <type>ssh_integrity_check_linux</type>
  <frequency>300</frequency>
  <host>us...@192.168.10.1</host>
  <state>periodic_diff</state>
  <arguments>/opt/webserver/conf /home/user/opsdev</arguments>
</agentless>

<!-- Tell me if a file is missing -->
<agentless>
  <type>ssh_generic_diff</type>
  <frequency>300</frequency>
  <host>us...@192.168.10.2</host>
  <state>periodic_diff</state>
  <arguments>find /opt/webserver/conf</arguments>
</agentless>

Thanks   

[rafael...@wazuh.com]

Hi Myke,

yes you are right, the agentless process is sequential right now. Your suggestion about making it multithreaded is very interesting and we will take this into account for our next roadmap.

Again thank you for your use case.

Best regards.