On Tue, 2008-12-16 at 10:21 +0200, Henrik K wrote: > On Mon, Dec 15, 2008 at 03:58:40PM -0800, John Hardin wrote: > > > > You should be able to run base SA, a bayes database (you'll probably want > > to avoid autolearning) and *some* custom rules. You might not be able to > > use the larger custom rules like the Sought sets - try them and see. > > Having some custom rules makes little difference. SA base code is huge. > Sought is small, we are talking about one or two MBs. This advice comes from > the age of *large* rules like blacklist.cf.
True. I am running both Sought rulesets myself. Sorry, I wrote that bit too quickly, and had blacklist.cf in the back of my mind. > Bayes has little effect on memory. If you use it as flat BerkeleyDB file, > only thing it might "take" is OS disk cache. And if it's on flash, access > should be very fast. I don't see anything preventing autolearning. We don't have any information on available disk, so I was assuming it was limited. > I've run full SA, ClamAV, MySQL, named, websites etc on 256MB. You do need > swap for it. If you have a filesystem, then you can create a swap file on > it. "no swap" was specified, which also suggests limited disk. > Of course you cannot expect it to perform miracles. You can have one or two > concurrent scans at maximum. And I forgot to mention that as well; when I was running with 192MB I had SA limited to one concurrent scan. It worked, just rather slowly. Fortunately my email volume is fairly low. -- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- "Bother," said Pooh as he struggled with /etc/sendmail.cf, "it never does quite what I want. I wish Christopher Robin was here." -- Peter da Silva in a.s.r ----------------------------------------------------------------------- 9 days until Christmas
