too frequent ftp of logs

[jeff.gift]

Hi,

I would simply like to ftp the logs off the IDSM to the ftp server once a day. My IDSM is sending them about every two minutes. Is there a setting somewhere other than the sapd config?

Thanks!

[wardwalk]

Hi Jeff,

Have you recently enabled log file ftp on your IDSM? It's likely that the log files being ftp'ed are older closed log files that have collected before log file ftp was enabled. Once these have all been ftp'ed, the ftp frequency should decrease because log files will only be ftp'ed as they're closed. Log files are closed on a time basis and a size basis. So, each time a log file gets full or too old, it's closed and is ftp'ed off.

If you're still seeing too frequent ftp'ing of log files, you may want to adjust what signatures your IDSM is alarming on.

Hope that helps.

Ward.