I got a 50mbit fiber line (50 up and 50 down) that is usually just running around 40mbit down. My box is currently on a Mirror port (SPAN port for the cisco guys out there).<div><br></div><div>Other pertinent info, I am also running OpenFPC on this box as well for network capture to (a second) disk. Could that be affecting Suricata (ie: Should I start Suricata first, and then start the network capture, or does it matter?</div>
<div><br></div><div>I just got Suri fired back up again, so I'll see what happens...</div><div><br></div><div> One final thought... I did an upgrade on my Firewall last night... It now has a better ability to block P2P traffic and such... If the firewall is blocking the P2P, that means suricata isn't having to process quite as large of a volume of packets... Could that be where all of my CPU usage went?</div>
<div><br></div><div>Thanks!<br>~Brant</div><div><br></div><div><div><div><div class="gmail_quote">On Fri, Mar 23, 2012 at 4:38 AM, Peter Manev <span dir="ltr"><<a href="mailto:petermanev@gmail.com">petermanev@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5"><br><br>
<div class="gmail_quote">On Fri, Mar 23, 2012 at 8:56 AM, Victor Julien <span dir="ltr"><<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT:#ccc 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex" class="gmail_quote">
<div>On 03/23/2012 05:46 AM, Brant Wells wrote:<br>> Hi All,<br>><br>> I just wanted to report in... The latest GIT version that I am running<br>> (Suricata 1.3dev (rev 22349f8)) has given me some very notable improvements!<br>
><br>> I almost wondered if Suricata had crashed a few minutes ago, because my<br>> web interface to BASE was lighting fast!<br>><br>> Anyhow, I did some checking and suricata is now running steady between<br>
> ~30% and 75% CPU usage... and roughtly 11% of my system memory (Quad<br>> core / 4GB box)... Before it was running at 99% Cpu usage and consuming<br>> 60% of the boxes RAM.<br><br></div>That memory things has me somewhat worried. We did do some optimization,<br>
but nothing should result in a factor 6 reduction I think.<br><br>What was the Suricata version you used before this?<br>
<div><br>> I went to check my stats.log and noticed that it was at the 2gb file<br>> limit, lol, so i don't have any hard numbers right now. I will restart<br>> it tomorrow and get some...<br>><br>
> I am using the suricata.yaml that comes with the source, and have only<br>> modified the IP Addresses to match my network, all other settings have<br>> been left at default...<br><br></div>We did change the default runmode from auto to autofp, which should<br>
scale much better:<br><a href="http://www.inliniac.net/blog/2012/03/23/suricata-runmode-changes.html" target="_blank">http://www.inliniac.net/blog/2012/03/23/suricata-runmode-changes.html</a><br><span><font color="#888888"><br>
--<br>---------------------------------------------<br>Victor Julien<br><a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br><br>_______________________________________________<br>Oisf-devel mailing list<br><a href="mailto:Oisf-devel@openinfosecfoundation.org" target="_blank">Oisf-devel@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br></font></span></blockquote></div>
<div><br><br clear="all"> </div>
<div> </div>
<div> </div>
</div></div><div>Hi Brant,</div>
<div> </div>
<div>how much traffic do you inspect?</div>
<div> </div>
<div>thanks</div><span class="HOEnZb"><font color="#888888">
<div> </div>
<div> </div>
<div><br>-- <br></div>
<div>Regards,</div>
<div>Peter Manev</div><br>
</font></span><br>_______________________________________________<br>
Oisf-devel mailing list<br>
<a href="mailto:Oisf-devel@openinfosecfoundation.org">Oisf-devel@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br></blockquote></div><br></div></div></div>