GBUdb

How often does the engine (re)reads the GBUdbIgnoreList.txt?

The GBUdb ignore list is reloaded each time the configuration is reloaded. If you change the GBUdbIgnoreList.txt file, or the snf_engine.xml file, or the rulebase (.snf) file then the SNFMulti engine detects these as a configuration change and will reload all of them within a second or two.

This is always done without interrupting scan operations. Existing scans are completed using the configuration that they started with. New scans will begin with the new configuration once it is loaded and valid.

Note that IPs put into the GBUdbIgnoreList.txt file will be posted to the active GBUdb. Removing them from the GBUdbIgnoreList.txt file _does not_ remove them from GBUdb.

This is also true of IPs learned from drilldown directives.

The GBUdbIgnoreList.txt file is a safety net that ensures the IPs listed will be ignored even if the GBUdb dataset is lost (such as a restart after deleting or corrupting the .gbx file).

If you remove IPs from the GBUdbIgnoreList.txt or directives from the drilldown section -- and you want the IPs to be changed in the GBUdb database then you must change them directly by either dropping their records or changing the flags on their records. (I only pass that on for completeness. In most cases this situation would never (or at least seldom) occur.)