A few days ago I noticed that the disk of my Ubuntu server was almost full. I dug a bit and found out that the disk space was used by OSSEC, in the /var/ossec/queue/diff folder.

I wanted to try something immediate so I deleted the contents of this folder. Everything was working normally and the disk space usage back to a "normal" amount.

But the OSSEC queue folder is growing again.

Is there a setting to prevent the OSSEC queue from using all the disk space?

3 Answers 3


As far as I know, OSSEC itself doesn't delete logs. Look at the documentation

Where are OSSEC’s logs stored?¶

On OSSEC server and local installs there are several classes of OSSEC logs. There are the logs created by the OSSEC daemons, the log messages from the agents, and the alerts. Agent installs do not have logs from other agents or alerts, but do have logs created by the OSSEC processes.

All logs are stored in subdirectories of /var/ossec/logs. OSSEC’s log messages are stored in /var/ossec/logs/ossec.log.

Log messages from the agents are not stored by default. After analysis they are deleted unless the option is included in the manager’s ossec.conf. If set all log messages sent to the manager are stored in /var/ossec/logs/archives/archives.log and rotated daily.

Alerts are stored in /var/ossec/logs/alerts/alerts.log, and rotated daily.

You can use logrotate to rotate the ossec logs, but the /var/ossec/queue/diff folder is another story.

You can safely delete the files in there and maintain OSSEC functionality, but you will lose the difference reports.

  • 2
    Sorry but I don't see the point between the logs and the folder /var/ossec/queue/diff that I mention. For now I'm only concerned about the disk space usage of that specific folder (logs only use a few KB).
    – Sinklar
    May 7, 2015 at 12:57
  • 2
    @Sinklar it was just a general tip to use logrotate on OSSEC logs, the other problem (/var/ossec/queue/diff) is exactly what I wrote. The directory won't be cleared / rotated by OSSEC or anything else, you have to write a script to delete /backup and move the files now and then, or delete them manually. Or you just stop using the option for logging file differences if you don't use them.
    – Lenniey
    May 7, 2015 at 13:53
  • 1
    @Lenniey what is stored in /var/ossec/queue/diff ? I can see a lot of files called 'last-entry', makes me assume that everytime this scan is run, last copy of the file is stored (for even binaries). My /var/ossec/queue/diff /local/etc is 16GB. At this point I have started to think it's not just last entry but a number of entries because my /etc is very light. Is there a way of clearing disk without impacting difference report? Jan 9, 2018 at 15:07

It seems if you add report_changes to your directories like i did it c an cause this: /home/wordpress/sites/

Report Changes OSSEC supports sending diffs when changes are made to text files on Linux and unix systems.

Configuring syscheck to show diffs is simple, add report_changes="yes" to the

/etc /bin,/sbin Note Report Changes can only work with text files, and the changes are stored on the agent inside /var/ossec/queue/diff/local/dir/file. If OSSEC has not been compiled with libmagic support, report_changes will copy any file designated, e.g. mp3, iso, executable, /chroot/dev/urandom (which would fill your hard drive). So unless libmagic is used, be very carefull on which directory you enable report_changes.


Logrotate is the answer (as mentioned by Lenniey), but this'll only work once in a while. Why not use the long forgotten lore of disk quota to prevent logs from eating all free space?

  • Maybe I just don't understand why you also suggest that but... again, I don't see a relation between logrotate, the OSSEC diff disk usage and how to tell OSSEC diff to not use all available disk space. It's not about logs, as far as I can tell.
    – Sinklar
    May 7, 2015 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.