aa-log -r is very slow with somewhat bigger logfiles.
On a 34 MB audit.log full of denials (actually 5 audit logs cat' together), it it takes 17 minutes.
With 16 MB, it takes about 2 minutes. (Tested with ~half of the 34 MB log.)
With 8 MB, it takes about 30 seconds (slightly depending on the file content - I tested the two halfes of the 16 MB log, one took 25 seconds, the other half 34 seconds).
This means the needed time grows exponentially with the log size.
Wild guess: Does aa-log compare the latest log entry with everything it has already seen? Something like this would explain the behaviour.
For comparison: aa-logprof only needs 5 seconds with the same 34 MB log until it asks the first question - and at this time, it has already parsed the complete log.
aa-log -ris very slow with somewhat bigger logfiles.On a 34 MB audit.log full of denials (actually 5 audit logs cat' together), it it takes 17 minutes.
With 16 MB, it takes about 2 minutes. (Tested with ~half of the 34 MB log.)
With 8 MB, it takes about 30 seconds (slightly depending on the file content - I tested the two halfes of the 16 MB log, one took 25 seconds, the other half 34 seconds).
This means the needed time grows exponentially with the log size.
Wild guess: Does aa-log compare the latest log entry with everything it has already seen? Something like this would explain the behaviour.
For comparison: aa-logprof only needs 5 seconds with the same 34 MB log until it asks the first question - and at this time, it has already parsed the complete log.