Re: Tripwire (clone) which would you prefer?
> In what sense? Logging to syslog/email/external database and signing the
Bringing machine to knees seems pretty intrusive to me.
Samhain runs as deamon, and IIRC it scans running processes and does other
things in effort to detect trojans and lkms. This activity used to boost
idle load avg from ~0.1-0.3 to ~1.0, and created serious problems with
handling peak loads.
AFAIK you can modify the way you want to run samhain, and it's been years
since I tried using samhain, so samhain probably became more efficient, and
todays 6G-ram 3Ghz cpus probably pack enough grunt to safely ignore
additional load, but one should always be carefull with 'extra features'.
--
Dariush Pietrzak,
Key fingerprint = 40D0 9FFB 9939 7320 8294 05E0 BCC7 02C4 75CC 50D9
Reply to: