[Aide] aide 0.11 is generating a VERY large database.

[Marc Haber]

On Thu, Nov 23, 2006 at 11:08:46AM +0000, Adam Funk wrote:
> On 2006-11-10, Marc Haber <mh+aide at zugschlus.de> wrote:
> >> I let it finish and the file is 102MB (compared to 2.2MB with 0.10)
> >> but at least I know it's finished.
> >
> > Sounds like you need to exclude even more ;)
> >
> > On my systems, I have typical (uncompressed) database sizes of like 20
> > MB.
> 
> On the machine still running 0.10-11, the database is 1.7MB
> compressed, with 37049 files.  The daily run takes 2 minutes.
> 
> On the machine running aide 0.11a-4, I'm now down to a 97MB
> uncompressed database, with 327313 files (according to aide.log).  The
> daily run takes 44 minutes.
> 
> I'm not bothered about the disk space, and I'm getting the numbers of
> daily added, removed and changed files down a bit --- but do those
> figures seem highly abnormal to you?

Yes, that's abnormally high.

$ sudo cat /var/lib/aide/aide.db | wc -l
64408

This is my busiest host. Most of my systems are well below 40K
lines, with the aide run taking well under ten minutes.

> Also, is it inadvisable to exclude /tmp/ and /var/log/ from aide since
> they have a lot of files that change every day anyway?

Debian's aide default configuration comes with a lot of
package-specific excludes which surely can be adapted to other
packages that I didn't write excludes for.

I'd advise excluding entire top-level trees.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835