The signature updates in 4.1 appear to take longer than the version 3.1 updates.
In version 3.1 the sensor software was stopped and restarted during a signature update. This happened fairly quickly from the typical user perspective. What most users did not realize is that after packetd was restarted, it would take several minuted to build new regular expression tables for the added signatures. So it was several additional minutes before packetd was actually monitoring traffic. ALso if for some reason packetd was not able to generate the regular expression tables the user was only notified through an error file after the user through the update was complete.
In version 4.1, the signature update does not stop and start sensorApp itself. Instead the new signatures are sent to sensorApp, and sensorApp begins building it's new regular expression tables which can take several minutes. It is only after the tables are built without errors that the user is notified that the update was successful. Then sensorApp automatically restarts itself on it's own (this takes just a few seconds).
So the big difference is not really in the time to do the update, but in the fact that in version 3.1 the user recieved a success message before the tables were built and could miss errors during table generation, while in 4.1 the user won't see success until after the table is built.
---------------
However, there are situations inwhich the update may be experiencing problems that could cause it to take longer.
If the file could not be downloaded to do the update then the user will need to wait for the update to timeout. This timeout can be several minutes, and usually happens when the sensor does not understand the ftp server's prompts, or when the file was not in the proper location on the ftp server.
WHen you execute the upgrade command on the sensor CLI, you need to wait until you recieve a response. You will receive either success or failure (usually a timeout failure). DO NOT stop and restart the sensor while waiting for the upgrade to finish because you could leave the sensor in a corrupted state.
