[Aide] aide 0.11 is generating a VERY large database.

[Andrej Ricnik-Bay]

On 12/4/06, Marc Haber <mh+aide at zugschlus.de> wrote:

> > !/usr/local/share
> Is /usr/local/share on the same file system as /usr/local?
Yes, and they are disparate from /usr (on a separate partition).  I use
/usr/local exclusively to back-up other machines to the server via
rsync...

> Do the files from /usr/local/share show up in the aide database as
> /usr/local/share or with some other prefix?
No other prefixes, I don't think.  will have to check when I get
home.


> > > To cut down your run time, I'd tail -f the new aide database and abort
> > > once you see files that do not belong there. If you have a lot of
> > > files that you want in your final aide database and that take a lot of
> > > time to check, you can exclude them during your tests. This will also
> > > give you a better feeling about exclude rules.
> > I don't think I want to watch for 4 hours ;}
> That's why I suggested to exclude some parts of the filesystem while
> you're testing.
Exclusion would be done how - temporarily moving some of the
\d+_ailde_.* files to a different directory?

> My "slowest" system takes like 30 minutes for the aide check.
Heh.  My server is a 11 year old IBM PC 330 with dual PPro 200s


> Greetings
> Marc
Cheers,
Andrej