[Dshield] DShield Work Schedule.
Johannes B. Ullrich
euclidian at euclidian.com
Mon Jul 2 19:10:55 GMT 2001
Yes, DShield processes submissions in batches.
Currently, this happens about once an hour. We had
some spiked in submissions lately, which made the
import run 'overtime'. In this case, the next import
can be delayed.
So it won't help to submit more than once an hour.
I think once per hour or at least one a day is a good
schedule. Don't submit less than once a day as the
most recent log files are always the most valuable
Another parameter to consider for large submitter:
Don't submit more than 1 MByte/submission. If you
report for a large subnet, and for example collect and
submit your logs once a day, your submission may run
over this limit. Drop me an e-mail for special arrangements.
Johannes Ullrich Join http://www.dshield.org
jullrich at sans.org
More information about the list