I wan to run a cron job on each of my hosts that sends a list of all open ports to a central db on which I will run auditing and forensic queries.
My question is how often should this job run so I could consider this coverage reliable. Obviously running it to often could potentially acquire too much resources from the host.
I hope my question makes sense. If it doesn't then what's the alternative.