Thanks for the info. Is there any diagnostic information available when a gbudb sync occurs?
On Tue, Feb 17, 2009 at 4:35 PM, Pete McNeil <madscient...@armresearch.com>wrote: > Richard Stupek wrote: > >> A question on GBUDB utilization. I show a current utilization of 95% >> (from the log file) which I assume means the amount of memory used from what >> is set aside for gbudb entries. Is that correct? >> > Yes. > >> What happens when more entries are added? Does the GBUdb grow or does it >> get pruned out? >> > Both. When more space is needed the ram allocated to GBUdb will grow to > accommodate the need. This should happen infrequently. When entries are no > longer active they are dropped to make room for additional entries. In > practice the GBUdb data size stabilizes quickly and then doesn't change > much. > > Once per day or as otherwise specified by GBUdb condensation triggers the > GBUdb data will be condensed. This means that all of the good and bad event > counts are divided in half. This has the effect of retaining the ratios > (probability of spam) while reducing the event counts (confidence figure). > Any ugly entries that drop to zero are dropped from the system (forgotten). > The remaining live entries are placed in a new GBUdb and the old one is > thrown away. If the GBUdb size can shrink during a condensation run then it > will. > >> Will gbudb XCI commands (like <bad>) show up in a log file? >> > No. These are administrative entries so they don't get reported in scan > activity. We may change this later but at present there are no requests for > it. > > Best, > > > _M > > > ############################################################# > This message is sent to you because you are subscribed to > the mailing list <sniffer@sortmonster.com>. > To unsubscribe, E-mail to: <sniffer-...@sortmonster.com> > To switch to the DIGEST mode, E-mail to <sniffer-dig...@sortmonster.com> > To switch to the INDEX mode, E-mail to <sniffer-in...@sortmonster.com> > Send administrative queries to <sniffer-requ...@sortmonster.com> > >
