Hi,
Upstream promised to look at implementing iNotify support in future, if it
can be done without compatibility issues to other platforms.
Here are Risto's comments on the issue overall:
"
SEC is not only about tracking new lines that are appended to the log files,
but it also does a lot of things based on the readings of the system clock.
In fact, in order to keep event correlation data structures in a more or less
consistent and reasonable state, SEC actually *needs* to process some data
structures at least once in a couple of seconds. This work needs to be
consistently done even if no data appears in input files for hours or days.
In other words, SEC needs to wake up after each few seconds anyway, in order
to check its internal state and accomplish various housekeeping tasks.
Therefore the inotify functionality is likely to provide no considerable
savings in terms of energy and CPU time.
However, if the author of the question is running SEC on a system where
it is specifically desired to avoid polling input sources for longer
amounts of time, I recommend to use larger timeout values for --poll_timeout
and --check_timeout options. If there are many files to monitor and most of
them change only infrequently, I would especially recommend using a large
value for --check_timeout option -- it is known to reduce the system load
dramatically if most input sources rarely change. "
--j
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
