Meaning of Tri-State "Log" Check Boxes

[meargh]

I searched but did not see this question addressed. Sorry if I missed it.

Could someone please tell me if I'm right about the meaning of each state of the Log check boxes in AppDefend? (It's mainly the "Half-checked" setting I'm unsure about.)

-{ Quote: "Checked: Event will be logged
Unchecked: Event will not be logged
Half-checked: Event will be logged if, and only if, this logging option is enabled for the .Default entry" }-

What confuses me is that even the .Default entry allows a half-checked state. Because if I'm right about what it means to be half-checked, it doesn't make sense for .Default to ... reference .Default.

[Jason_R0]

-{ Quote: "I searched but did not see this question addressed. Sorry if I missed it.

Could someone please tell me if I'm right about the meaning of each state of the Log check boxes in AppDefend? (It's mainly the "Half-checked" setting I'm unsure about.)



What confuses me is that even the .Default entry allows a half-checked state. Because if I'm right about what it means to be half-checked, it doesn't make sense for .Default to ... reference .Default." }-

Hi meargh,

You are correct, however when the CHECKBOX is "grayed" or in the indeterminate state for the .Default rule, it is the same as if it was TICKED. I am going to be removing the checkboxes most likely and giving another dropdown list for logging options. Simply because I think there should be more options.

[berng]

Right now it seems that once you set a log entry to checked or unc-checked you can't go back to half-checked.

Also, it would be nice to set log options to log only if denied.

[berng]

-{ Quote: "Right now it seems that once you set a log entry to checked or unc-checked you can't go back to half-checked." }-
Actually, this now works with the latest release.

[nameless1]

-{ Quote: "I am going to be removing the checkboxes most likely and giving another dropdown list for logging options. Simply because I think there should be more options." }-
I like to have all new alerts logged. But once I approve an action for a given program, there is no way to have that action automatically bypass the log (i.e. not be logged). So, for each application I add, I have to go in and uncheck the applicable boxes.

It would be great if you added some way to have only new alerts be logged.

[[suave]]

I'd like to be able to clear the log.

Or even be able set the maximum entries the log is allowed to hold.

does a big log take up alot of memory?

[nameless1]

I believe that serious enhancements to the logging system are in the works. I don't know the details.

A big log can take a lot of memory. When I kept the AppDefend settings at their defaults, I once noticed GSS.EXE taking over 100 MB of physical memory. It can very easily get out of hand.

[tony62]

-{ Quote: "I believe that serious enhancements to the logging system are in the works. I don't know the details.

A big log can take a lot of memory. When I kept the AppDefend settings at their defaults, I once noticed GSS.EXE taking over 100 MB of physical memory. It can very easily get out of hand." }-
I've noticed GSS.EXE running up memory in the region of 270 MB of physical memory, when logging 'JAVAW' Network Access.:o Of course i have now unchecked it's checkbox;D