Re: is there any processor-dependency to sa-compile?

[Justin Mason <jm...@jmason.org>]

snowcrash+sa writes:
> as long as my
> 
>   SA-version
>   included rulesets
>   enabled plugins
> 
> are the SAME from arch/OS to arch/OS, is it OK to simply compile rules
> once somewhere, and push them to each box?
> 
> or, *is* there some sort of processor/architecture, or other
> environmental, depdency that throws a wrench into the works?

it's compiled C code, so whatever affects portability of that will
affect compiled rulesets too.

--j.

Re: is there any processor-dependency to sa-compile?

[snowcrash+sa <sc...@gmail.com>]

hi,

> I think either different family, or different CPU arch, will be a
> problem to be honest...

yeah, probably right ... worth a look-see, though.

(or, i should simply build that 16-core Opteron box and be done with it ...)

> Yep, with a HUP.

thanks.

cheers!

Re: is there any processor-dependency to sa-compile?

[snowcrash+sa <sc...@gmail.com>]

hi,

> it's compiled C code, so whatever affects portability of that will
> affect compiled rulesets too.

likely depends on choices of compile-time optimization, i think.

need to read up, and check if/what presumptions are made by sa-compile process.

i've cross-compiled across different arch's within a CPU family
before, so that's not an issue.  i've *not* done so across different
CPUs (e.g., PPC vs x86), so that'll need some investigation.

assuming 'all that' gets ironed out, is it sufficient to simply 'push'
the "/compiled" dir's contents to each box -- with a HUP of SA, i'd
guess?  or does each SA instance need to be otherwise 'informed' of
the presence/change of compiled rules/files?

thanks!