[Aide] aide 0.11 is generating a VERY large database.

Marc Haber mh+aide at zugschlus.de
Sun Dec 3 19:39:17 EET 2006


On Mon, Dec 04, 2006 at 06:25:54AM +1300, Andrej Ricnik-Bay wrote:
> On 12/2/06, Marc Haber <mh+aide at zugschlus.de> wrote:
> > Mainly, it's a mixture of "deepest match wins" and "last match wins",
> > which is the cause that the more special rules are "late" in the
> > Debian rule set.
> Sorry, I must be quite thick  :} ... if I wanted to create a rule that
> for example excluded /usr/local/share ... what number would I
> be wanting to choose to achieve that?  I don't want to do to many
> testruns because on my old dog of a server a complete run of AIDE
> takes anywhere between 4 to 6 hours.  31_aide_usrlocal didn't do the
> trick, I'm afraid, because aide is still running and I hoped my change
> would cut the files to be checked down by half (I expected it to be
> done in under 3 hours).

What did you write to 31_aide_usrlocal?

To cut down your run time, I'd tail -f the new aide database and abort
once you see files that do not belong there. If you have a lot of
files that you want in your final aide database and that take a lot of
time to check, you can exclude them during your tests. This will also
give you a better feeling about exclude rules.

aide does not currently offer any better configuration tools.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835


More information about the Aide mailing list