Re: [fwAnalog] FWANALOG IS TOO SLOW

From: Balázs Bárány (balazs~AT~tud.at)
Date: Sat Aug 07 2004 - 07:54:48 CEST

• Next message: MERCERON, Florian: "[fwAnalog] Searching for regex expression with Checkpoints Firewall-1"
• Previous message: Gustavo Naigeboren: "[fwAnalog] FWANALOG IS TOO SLOW"
• In reply to: Gustavo Naigeboren: "[fwAnalog] FWANALOG IS TOO SLOW"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Hello,

• Gustavo Naigeboren <gusnaige~AT~requestnetworks.com> [2004-08-07 00:31]:
  > I am try to analyze a very large log file (like 12 mb) and it's still
  > running for more than 4 hours. What's wrong ?
  First, start "top" or some other program for determining the CPU usage. Chances are that analog is waiting for domain name lookups most of the time. You can look into your $outdir, you will probably see that there is a file called "analog-domains.tab" being appended with a few new lines each minute.

This happens only on the first run because the domain names are cached in analog-domains.tab so subsequent runs should be faster.

If there is no analog-domains.tab, it's probably a bug in fwanalog, in this case you should send me the contents of your fwanalog.opts file and more information about your config.

Regards

-- 
_________________________________________________________________
Balázs Bárány     balazs~AT~tud.at     http://tud.at    ICQ 10747763

Computers. You can't live with them, you can't live without them.

• Next message: MERCERON, Florian: "[fwAnalog] Searching for regex expression with Checkpoints Firewall-1"
• Previous message: Gustavo Naigeboren: "[fwAnalog] FWANALOG IS TOO SLOW"
• In reply to: Gustavo Naigeboren: "[fwAnalog] FWANALOG IS TOO SLOW"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.5 : Tue Aug 17 2004 - 13:02:03 CEST