Meaning of Tri-State "Log" Check Boxes

I searched but did not see this question addressed. Sorry if I missed it.

Could someone please tell me if I'm right about the meaning of each state of the Log check boxes in AppDefend? (It's mainly the "Half-checked" setting I'm unsure about.)

What confuses me is that even the .Default entry allows a half-checked state. Because if I'm right about what it means to be half-checked, it doesn't make sense for .Default to ... reference .Default.

 

Hi meargh,

You are correct, however when the CHECKBOX is "grayed" or in the indeterminate state for the .Default rule, it is the same as if it was TICKED. I am going to be removing the checkboxes most likely and giving another dropdown list for logging options. Simply because I think there should be more options.

 

Right now it seems that once you set a log entry to checked or unc-checked you can't go back to half-checked.

Also, it would be nice to set log options to log only if denied.

 

Actually, this now works with the latest release.

 

I like to have all new alerts logged. But once I approve an action for a given program, there is no way to have that action automatically bypass the log (i.e. not be logged). So, for each application I add, I have to go in and uncheck the applicable boxes.

It would be great if you added some way to have only new alerts be logged.

 

I'd like to be able to clear the log.

Or even be able set the maximum entries the log is allowed to hold.

does a big log take up alot of memory?

 

I believe that serious enhancements to the logging system are in the works. I don't know the details.

A big log can take a lot of memory. When I kept the AppDefend settings at their defaults, I once noticed GSS.EXE taking over 100 MB of physical memory. It can very easily get out of hand.

 

I've noticed GSS.EXE running up memory in the region of 270 MB of physical memory, when logging 'JAVAW' Network Access. Of course i have now unchecked it's checkbox