[Aide] aide 0.11 is generating a VERY large database.

[Marc Haber]

On Mon, Dec 04, 2006 at 08:25:21AM +1300, Andrej Ricnik-Bay wrote:
> On 12/4/06, Marc Haber <mh+aide at zugschlus.de> wrote:
> 
> > What did you write to 31_aide_usrlocal?
> !/usr/local/share

Is /usr/local/share on the same file system as /usr/local?

Do the files from /usr/local/share show up in the aide database as
/usr/local/share or with some other prefix?

> > To cut down your run time, I'd tail -f the new aide database and abort
> > once you see files that do not belong there. If you have a lot of
> > files that you want in your final aide database and that take a lot of
> > time to check, you can exclude them during your tests. This will also
> > give you a better feeling about exclude rules.
> I don't think I want to watch for 4 hours ;}

That's why I suggested to exclude some parts of the filesystem while
you're testing.

My "slowest" system takes like 30 minutes for the aide check.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835