<meta charset="utf-8"><span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px; border-collapse: collapse; ">Aki,<div><br></div><div>Are you monitoring one network interface per Suricata instance?</div>
<div><br></div><div>It seems like an old security appliance that my company used had a single instance of snort running for each interface on the box.</div><div><br></div><font color="#888888"><div>~Brant</div></font></span><br>
<div class="gmail_quote">On Tue, Jul 20, 2010 at 9:14 AM, Aki Heikkinen <span dir="ltr"><<a href="mailto:aki.heikkinen@kuusisolutions.fi">aki.heikkinen@kuusisolutions.fi</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hi,<br>
<br>
We're running 7 to 10 suricata 1.0 instances on old 2,7GHz quad<br>
processor xeon server (with hyperthreading so OS sees 8 cores), used to<br>
run snort_inline on same hardware (snort_inline instances attached to<br>
different cores). Suricata instances suck up cpu cycles. I can<br>
understand this for high traffic-volume instances which has hundreds of<br>
UDP connections passing through but half of the instances are mainly<br>
idling.<br>
<br>
top - 15:45:14 up 76 days, 7:41, 4 users, load average: 5.09, 5.40, 5.37<br>
Tasks: 135 total, 4 running, 131 sleeping, 0 stopped, 0 zombie<br>
Cpu(s): 8.5%us, 21.4%sy, 0.0%ni, 70.0%id, 0.0%wa, 0.0%hi, 0.0%si,<br>
0.0%st<br>
Mem: 3961684k total, 3712484k used, 249200k free, 245996k buffers<br>
Swap: 7815612k total, 282032k used, 7533580k free, 593384k cached<br>
<br>
<br>
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND<br>
<br>
23732 suricata 20 0 369m 160m 1588 S 55 4.2 10368:21 suricata<br>
23728 suricata 20 0 455m 228m 1484 S 53 5.9 10367:21 suricata<br>
14068 suricata 20 0 378m 225m 1600 S 49 5.8 27:37.22 suricata<br>
23734 suricata 20 0 832m 545m 1640 R 49 14.1 13311:46 suricata<br>
23730 suricata 20 0 408m 237m 1540 S 48 6.1 10373:09 suricata<br>
23726 suricata 20 0 477m 310m 1612 S 46 8.0 10383:05 suricata<br>
23724 suricata 20 0 789m 589m 1620 S 44 15.2 11698:04 suricata<br>
<br>
Any tips would be appreciated howto tune suricata to better use<br>
resources on this hardware. Current config is pretty much suricatas<br>
default with most ET signatures enabed.<br>
<br>
Hopefully suricata manual will be out soon! :)<br>
<br>
Yours,<br>
<br>
Aki Heikkinen<br>
<br>
_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
</blockquote></div><br>