> > ON THE OTHER HAND -- no one has mentioned on a busy system > > wouldn't polling be LESS CPU intensive? (at the sacrifice of possibly > > missing some filter hits) > > You shouldn't miss anything, even with polling, only a time lag will be > introduced. If properly implemented fail2ban knows its position in the > log file regardless of how often it runs. Generally interrupt driven > systems are more efficient and have better response time than polling. > You can always use a faster computer. Interrupt driven system can > generally handle large numbers of interrupts per second. Yes, it can > become a problem if the number of interrupts is excessive, but in > practice fail2ban works for most people. If you have thousands of lines > written to you log file per second, or even hundreds, you may have a > problem. Even the busiest systems I've seen are not that bad. If your > system is that busy, then fail2ban might not work for you. > > All software has bugs. That's just how it is. I've used both gamin and > python-inotify and they both seem to work. I have not heard others > complain about this issue. Tailing log files to implement intrusion > detection is a compromise, over building a direct interface between all > components of the system and a central daemon that would manage those > events. In practice it works and it's easier to implement. > > > > > > Does inotify (pyinotify) have limits set so it doesn't wake > > up f2b process too many times a second? > > > > > > > Probably not, but I don't know without reading the code. There are > multiple ways to handle interrupts that occur when you are already > within another interrupt.
OK, thank you, now I have a better sense of what these backends do and their applications/strengths/ weaknesses. thank you very much for your time and expertise. ------------------------------------------------------------------------------ Don't Limit Your Business. Reach for the Cloud. GigeNET's Cloud Solutions provide you with the tools and support that you need to offload your IT needs and focus on growing your business. Configured For All Businesses. Start Your Cloud Today. https://www.gigenetcloud.com/ _______________________________________________ Fail2ban-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fail2ban-users
