jtimberman/ossec-cookbook — pull request #34 by jgoldschrafe (2014-12-04 06:56:30+00:00)
Title: Support for partial search

If `node['ossec']['use_partial_search']` is set to true, use a partial search instead of a full node search to avoid running the node out of memory.