Does psad have a small OS footprint?
Even though the main psad daemon is written in perl, the footprint it has on the underlying operating system is quite small since psad spends most of its time sleeping and only periodically wakes up (every five seconds by default) to check if new packets have been logged by iptables. On my home system (PIII 700, 750MB) psad consistently runs at 0% CPU and 0.5% memory utilization unless I’m hit by a heavy scan.
