> From: Bowie Bailey [mailto:[EMAIL PROTECTED] > > Rosenbaum, Larry M. wrote: > > > From: Bowie Bailey [mailto:[EMAIL PROTECTED] > > > > > > I would say that sa-compile is the preferred method due to its > > > performance benefits. There aren't many (any?) drawbacks to using > > > it. > > > > I don't use it here because it takes too long (over 20 minutes) to > > compile. (This is with SA v3.2.4, which is a big improvement over > > v3.2.3) > > Why is this an issue? You only have to recompile the rules if there is > an update and this is only once every week or two even when things are > active.
We have a lot of local rules that I fine-tune often, sometimes several times a day.
