We have a data-center and as a happy OSSEC user I am trying to convince my management to use it for host intrusion detection. However I have never deployed it on more than a handful of servers and I am not sure if it does scale.
Anyone has deployed OSSEC on a large scale (say 500+ servers) ? Does it scale ?
I help manage an existing deployment of 3300+ agents using a single OSSEC server that generates ~300k alerts every 24 hours.
From the OSSEC newsgroup and from direct communications I know of several OSSEC installations that go well beyond 6000 agents (typically configured using multiple OSSEC servers).
Things that we did that helped:
Discussion on the OSSEC list says that, with a recompile, a server can host tons of agents (the poster there, who I believe is the founder of OSSEC, says he has tried 2048).