diff --git a/README.ja.md b/README.ja.md index fdae0cf4..a2d13f1a 100644 --- a/README.ja.md +++ b/README.ja.md @@ -290,20 +290,23 @@ $ vuls tui ---- # Performance Considerations -- Ubuntu, Debian and CentOS -アップデート対象のパッケージが沢山ある場合は、Changelogをパースするので遅いし、スキャン対象サーバのリソースを消費する。 +- Ubuntu, Debian +アップデート対象のパッケージが沢山ある場合は、毎回apt-get changelogするので遅いし、スキャン対象サーバのリソースを消費する。 + +- CentOS +アップデート対象すべてのchangelogを一度で取得しパースする。スキャンスピードは高速、サーバリソース消費量は小さい。 - Amazon, RHEL and FreeBSD 高速にスキャンし、スキャン対象サーバのリソース消費量は小さい。 | Distribution| Scan Speed | Resource Usage On Target Server | |:------------|:-------------------|:-------------| +| Ubuntu | Slow | Heavy | +| Debian | Slow | Heavy | +| CentOS | Fast | Light | | Amazon | Fast | Light | | RHEL | Fast | Light | | FreeBSD | Fast | Light | -| Ubuntu | Slow | Heavy | -| Debian | Slow | Heavy | -| CentOS | Slow | Heavy | ---- diff --git a/README.md b/README.md index 0eda8641..b3d43233 100644 --- a/README.md +++ b/README.md @@ -289,20 +289,25 @@ see https://github.com/future-architect/vuls/tree/master/setup/docker ---- # Performance Considerations -- on Ubuntu, Debian and CentOS -Vuls parses a changelog of upgradable packages. The scan speed is slow and resource usage is heavy when there are many updatable packages on target server. +- on Ubuntu and Debian +Vuls issues `apt-get changelog` for each upgradable packages and parse the changelog. +`apt-get changelog` is slow and resource usage is heavy when there are many updatable packages on target server. + +- on CentOS +Vuls issues `yum update --changelog` to get changelogs of upgradable packages at once and parse the changelog. +Scan speed is fast and resource usage is light. - On Amazon, RHEL and FreeBSD High speed scan and resource usage is light because Vuls can get CVE IDs by using package manager(no need to parse a changelog). | Distribution| Scan Speed | Resource Usage On Target Server | |:------------|:-------------------|:-------------| +| Ubuntu | Slow | Heavy | +| Debian | Slow | Heavy | +| CentOS | Fast | Light | | Amazon | Fast | Light | | RHEL | Fast | Light | | FreeBSD | Fast | Light | -| Ubuntu | Slow | Heavy | -| Debian | Slow | Heavy | -| CentOS | Slow | Heavy | ---- diff --git a/img/vuls-architecture.graphml b/img/vuls-architecture.graphml index 84ba3f90..c85fe548 100644 --- a/img/vuls-architecture.graphml +++ b/img/vuls-architecture.graphml @@ -392,7 +392,7 @@ ALAS (Amazon) - + @@ -411,7 +411,7 @@ ALAS (Amazon) - + @@ -452,7 +452,7 @@ ALAS (Amazon) - + Fetcher @@ -605,7 +605,7 @@ Container - Fetch + Fetch Vulnerability data @@ -806,25 +806,7 @@ Vulnerability data - Insert - - - - - - - - - - - - - - - - - - Select + Insert @@ -901,6 +883,44 @@ Scan Result + + + + + + + + --cve-dictoianry-dbpath option + + + + + + + + + + + + + + + + + + + Select + + + + + + + + + + + diff --git a/img/vuls-architecture.png b/img/vuls-architecture.png index a83dc634..ae5afebf 100644 Binary files a/img/vuls-architecture.png and b/img/vuls-architecture.png differ diff --git a/img/vuls-scan-flow.graphml b/img/vuls-scan-flow.graphml index d9e7f7a2..8fd15da2 100644 --- a/img/vuls-scan-flow.graphml +++ b/img/vuls-scan-flow.graphml @@ -17,7 +17,7 @@ - + Detect the OS @@ -33,7 +33,7 @@ - + @@ -50,17 +50,17 @@ - + - Get installed packages + Get installed packages Debian/Ubuntu: dpkg-query Amazon/RHEL/CentOS: rpm FreeBSD: pkg - + @@ -69,12 +69,11 @@ FreeBSD: pkg - + - Get upgradable packages -Debian/Ubuntu: apt-get upgrade --dry-run -CentOS: yum check-upduate + Get upgradable packages +Debian/Ubuntu: apt-get upgrade --dry-run @@ -87,7 +86,7 @@ CentOS: yum check-upduate - + foreach @@ -104,12 +103,11 @@ upgradable packages - + - Get CVE IDs in the changelog -Debian/Ubuntu: aptitude changelog -CentOS: yum changelog + Parse changelog and get CVE IDs +Debian/Ubuntu: aptitude changelog @@ -122,7 +120,7 @@ CentOS: yum changelog - + end loop @@ -138,7 +136,7 @@ CentOS: yum changelog - + Select the CVE detail information @@ -154,7 +152,7 @@ CentOS: yum changelog - + Get CVE IDs by using package manager @@ -172,7 +170,7 @@ FreeBSD: pkg audit - + Vuls DB @@ -188,10 +186,27 @@ FreeBSD: pkg audit - + - CVE DB (NVD / JVN) + CVE DB (NVD / JVN) + + + + + + + + + + + + + + + + Insert results into DB +Reporting @@ -201,18 +216,34 @@ FreeBSD: pkg audit - + - + - Insert results into DB -Reporting + Get all changelogs by using package manager +CentOS: yum update --changelog - + + + + + + + + + + + + + Parse changelogs and get CVE IDs + + + + @@ -231,16 +262,17 @@ Reporting - + + + - Debian -Ubuntu -CentOS + Debian +Ubuntu - + @@ -281,7 +313,9 @@ CentOS - + + + @@ -292,17 +326,17 @@ CentOS - + - Amazon + Amazon RHEL FreeBSD - + @@ -313,9 +347,7 @@ FreeBSD - - - + @@ -345,7 +377,9 @@ FreeBSD - + + + @@ -355,13 +389,56 @@ FreeBSD - + + + + + + + + + CentOS + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/img/vuls-scan-flow.png b/img/vuls-scan-flow.png index 8f361ffc..a29dbee5 100644 Binary files a/img/vuls-scan-flow.png and b/img/vuls-scan-flow.png differ