How is the method described in the FAQ any less expensive? Seems to me
it's just time delayed/batch oriented - still has the same "expensive"
tcpdump | logger plus you pay a little interest for the cron initiated
shell scripts.
Theo de Raadt wrote:
Isn't the load a function of what I choose to log in pf.conf?
I'm not talking system load. The logging operation you have created
is expensive.
--
_ _ _
__| | __ _ _ __ | |__ __ _ ___ ___| | ___ _ __
/ _` |/ _` | '_ \ | '_ \ / _` / __/ __| |/ _ \ '__|
| (_| | (_| | | | | | | | | (_| \__ \__ \ | __/ |
\__,_|\__,_|_| |_| |_| |_|\__,_|___/___/_|\___|_|
[EMAIL PROTECTED]
