grsecurity forums

Hello.

It's my first time on this forum. Sorry for my english.

I have little problem witch building acl.

After five days logging (gradm -F -L learning.log), my learning log have 1,5 GB.

And then..

serv:/etc/grsec# gradm -F -L /etc/grsec/learning.log -O acl
Beginning full learning 1st pass...done.
Beginning full learning role reduction...done.
Beginning full learning 2nd pass...malloc: Cannot allocate memory

Sometimes..

serv:/etc/grsec# gradm -F -L /etc/grsec/learning.log -O acl
Beginning full learning 1st pass...done.
Beginning full learning role reduction...done.
Beginning full learning 2nd pass...Killed


Some helpfull information:
Linux tkdami 2.4.27-grsec #3 SMP Fri Aug 13 10:13:33 CEST 2004 i686 Mem: 2019
Intel(R) XEON(TM) CPU 2.00GHz x 2

What is the problem?

Best regards!

--
gooroo

See the other posts on this subject. Gradm can't handle learning logs that large. Most likely some commands ran on your system that accessed all the files on the machine multiple times. I'm working on changes to the learning system that will greatly reduce the learning log size and memory footprint.

-Brad