Re: SA filter load: massive increase

[Justin Mason <jm...@jmason.org>]

Garry Glendown writes:
> Matt Kettler wrote:
> > In general I'd take a look at the sizes of the rule files themselves..
> > Look for ones that are significantly larger than 128k or so.
> 
> Of those, there only few:
> 
> -rw-r--r--  1 root root 384645 Oct 30  2005 70_sare_header.cf
> -rw-r--r--  1 root root 158513 Oct  1  2005 70_sare_obfu.cf
> 
> Given both are significantly older than the occurrence of the
> performance decrease, neither should be the cause ... in fact, the only
> sare-rules that have dates newer than Oct 1st are sare_stocks and
> sc_top200 ...

for what it's worth, I would suggest an iterative search -- remove all
extra rulesets, and re-add them gradually until you spot one or two
that are causing the load issues.

--j.