<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Rmkml,<div><br></div><div>Thanks for the idea. I have just checked alerts before and after drop in count. I see some alerts that occur before and after. It's just the number of alerts gets reduced dramatically.</div><div>I mean from like 300 to 40. It feels that if I let it run longer, it would drop even lower.</div><div><br></div><div>It also looks like drop in alerts starts to drastically decrease after about 5 or so hours of Suricata running after service restart.</div><div><br></div><div>The only idea that I have is that Suricata reduces number of false positives since HTTP session table gets build out.</div><div><br></div><div>Thank you.<br><br><div>> Date: Mon, 27 Oct 2014 17:58:21 +0100<br>> From: rmkml@yahoo.fr<br>> To: coolyasha@hotmail.com<br>> CC: oisf-users@lists.openinfosecfoundation.org; rmkml@yahoo.fr<br>> Subject: Re: [Oisf-users] Performance Issues<br>> <br>> Hi Yasha,<br>> <br>> Sorry I didn't help,<br>> <br>> but maybe you could enable wget ET sigs (2007961) and check if it's work every hour for example with simple 'wget --user-agent="wget 3.0" http://google.com'....<br>> (on my example, don't forget check $HOME_NET... on this sig)<br>> <br>> Do you have same pb with latest v2.0.4 ?<br>> <br>> Regards<br>> @Rmkml<br>> <br>> <br>> On Mon, 27 Oct 2014, Yasha Zislin wrote:<br>> <br>> > <br>> > [clear.gif] [clear.gif] [clear.gif] [clear.gif]<br>> > <br>> > PERFORMANCE ISSUE<br>> > <br>> > Hi,<br>> > <br>> > I am having a weird performance issue with Suricata.<br>> > I have Suricata 2.0.1 running on a beefy server (132gb of RAM, 40 Logical CPUs). It is monitoring two Span ports with mostly HTTP(S) traffic.<br>> > Each interface approximately has 10 million packets per second throughput. I am using PF_RING to reduce packet loss.<br>> > Suricata has been running great. I've tweaked all of the buffers to reduce packet loss to 0%.<br>> > Recently, I've noticed that number of alerts is way down from normal even with no packet loss. So I've tried restarting Suricata, and alerts went back to normal baseline.<br>> > I need to find out what is going on. Not sure where to look.<br>> > <br>> > Couple of things about my setup:<br>> > - When Suricata starts, it is using 60 gb of RAM. I've noticed when alert count goes down, memory usage is at 105gb.<br>> > - After Suricata service restart, it runs for about a day until alert count decreases.<br>> > - All CPUs are kicking and at no stage does any single CPU gets to 100%.<br>> > - I have 20 detection threads per interface.<br>> > - I have 26k ruleset. I know it's big but since I got RAM, I've figured I should be ok.<br>> > - Here is my stream section of the config:<br>> > stream:<br>> > memcap: 60gb<br>> > checksum-validation: no # reject wrong csums<br>> > inline: no # auto will use inline mode in IPS mode, yes or no set it statically<br>> > prealloc-sessions: 2000000<br>> > midstream: false<br>> > asyn-oneside: false<br>> > reassembly:<br>> > memcap: 90gb<br>> > depth: 4mb # reassemble 1mb into a stream<br>> > toserver-chunk-size: 2560<br>> > toclient-chunk-size: 2560<br>> > randomize-chunk-size: yes<br>> > #randomize-chunk-range: 10<br>> > #raw: yes<br>> > chunk-prealloc: 3000000<br>> > segments:<br>> > - size: 4<br>> > prealloc: 15000<br>> > - size: 16<br>> > prealloc: 200000<br>> > - size: 112<br>> > prealloc: 400000<br>> > - size: 248<br>> > prealloc: 300000<br>> > - size: 512<br>> > prealloc: 200000<br>> > - size: 768<br>> > prealloc: 100000<br>> > - size: 1448<br>> > prealloc: 1000000<br>> > - size: 65535<br>> > prealloc: 400000<br>> > <br>> > Thank you.<br>> > <br>> ><br></div></div> </div></body>
</html>