[Aide] Compare too aggressive

[Vijay]

Proskurin,
Not sure what you mean by "aggressive" but if you are seeing high loads
during aide execution, consider updating the checksums you calculate.

Instead of using something like:
Checksums = md5+sha1+rmd160+haval+gost+crc32+tiger+whirlpool

Use:
Checksums = sha1+md5

Also assess your aide config file to eliminate unnecessary checks.

Adding a sleep "a few sec" between two file compares can result in extremely
lengthy run time.  A CentOS 5 server with minimal packages alone can have up
to 40,000 files, so even inserting a 1 sec sleep between each check would
result in something like a 11+ hour run time.

Maybe you can provide some more details on what you are trying to do and
what your current configuration looks like.

Thanks,
Vijay

On Wed, Dec 22, 2010 at 2:10 AM, Proskurin Kirill
<k.proskurin at corp.mail.ru>wrote:

> On 12/22/2010 08:27 AM, Hannes von Haugwitz wrote:
> > On Mon, Dec 13, 2010 at 07:06:53PM +0300, Proskurin Kirill wrote:
> >> We found what aide compare is too aggressive for our needs.
> >> Could you tell me - there is source I can add sleep a few sec between
> >> two files compare?
> >
> > I'm not sure if I understand your problem but it sounds that aide is
> > eating too much of the system's resources. If so, maybe you could try to
> > renice the aide process.
>
> Yes we use renice but is is not a the way we want to fix it and it is
> not work well for us. We prefer tiny sleep between each files check.
>
> We check really many files at one time.
>
>
> --
> Best regards,
> Proskurin Kirill
> _______________________________________________
> Aide mailing list
> Aide at cs.tut.fi
> https://mailman.cs.tut.fi/mailman/listinfo/aide
>



-- 
"Knowledge is the only wealth that grows as you spend it, and diminishes as
you save it."
-- ancient Sanskrit saying
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://mailman.cs.tut.fi/pipermail/aide/attachments/20101222/d682bbe0/attachment.html