On Fri, 26 Oct 2007 09:43:37 -0700 (PPT), "John D. Hardin" <[EMAIL PROTECTED]> wrote:
>On Fri, 26 Oct 2007, Duane Hill wrote: > >> > But people don't read logs, or they would know... I'd suggest die-ing >> > instead. >> >> Why not make it a configurable option in local.cf defaulting to >> die. That way for those of us who create custom .cf files that >> have the system resources can do so and not have to split them up >> into more than one file. > >No, the size-to-die-at should be configurable, not whether you die or >warn. If you *want* to support large custom config files, then up the >limit. Perhaps a little more info about each rule would be helpful? I've ended up with mine through a variety of trial and error and list post comments and suggestions. I run SA on a dedicated machine and it has had problems in the past, though admittedly some of those could have been attributed to a combination of remote DNS and remote MySQL. Still, some explanation regarding the caveats (which _are_ included in some rules info) could help the process some? Just my 2p worth. Kind regards Nigel. BTW - 5 days to Halloween and the little buggers are knocking my door already - some things American should remain American! :-D
