grsecurity forums

Hello,

is it possible to concatenate two learning log files to make the policy?




Example:

1)

Code: Select all

gradm -F -L /etc/grsec/learning01.log
gradm -D
gradm -F -L /etc/grsec/learning01.log -O /etc/grsec/policy

2) (few weeks later)

Code: Select all

gradm -F -L /etc/grsec/learning02.log
gradm -D
cat learning01.log learning02.log > new_learning.log # I don't want lose the old learning file
gradm -F -L /etc/grsec/new_learning.log -O /etc/grsec/policy

Do I use the good way, to make a full learning increasing little by little?



Sorry for my bad english,

Thanks in advance,

Best regards,
Romain

It's possible to do that, yes. Depending on the size of the log, it may be useful to sort -u the file before running the final policy generation command.

-Brad