[Dshield] DShield Work Schedule.

Johannes B. Ullrich euclidian at euclidian.com
Mon Jul 2 19:10:55 GMT 2001

   Yes, DShield processes submissions in batches.
Currently, this happens about once an hour. We had
some spiked in submissions lately, which made the
import run 'overtime'. In this case, the next import
can be delayed.

   So it won't help to submit more than once an hour.
I think once per hour or at least one a day is a good
schedule. Don't submit less than once a day as the 
most recent log files are always the most valuable 

   Another parameter to consider for large submitter:
Don't submit more than 1 MByte/submission. If you 
report for a large subnet, and for example collect and
submit your logs once a day, your submission may run
over this limit. Drop me an e-mail for special arrangements.


Johannes Ullrich            Join http://www.dshield.org
jullrich at sans.org

More information about the list mailing list