<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I had this issue as well. setting sgh-mpm-context to full and my 132gb of RAM would disappear without suricata fully starting.<div>I assume if setting this to full would increase performance if you have sufficient hardware.</div><div><br></div><div>My ruleset is 20k rules. :)<br><br><div>> Date: Wed, 5 Nov 2014 11:24:01 +0100<br>> From: petermanev@gmail.com<br>> To: lists@inliniac.net<br>> CC: oisf-users@lists.openinfosecfoundation.org<br>> Subject: Re: [Oisf-users] Suricata, 10k rules, 10Gbit/sec and lots of RAM<br>> <br>> On Wed, Nov 5, 2014 at 10:28 AM, Victor Julien <lists@inliniac.net> wrote:<br>> > On 11/05/2014 08:11 AM, Peter Manev wrote:<br>> >>> I'm kind of concerned that rules cannot fit in the memory with<br>> >>> > sgh-mpm-context set to full and the settings presented. Should I be?<br>> >>> > :)<br>> >> There is a bug at the moment when using full with over 10k rules - it just ends up eating all the memory.<br>> ><br>> > What bug is this?<br>> ><br>> <br>> Tightly related to -<br>> https://redmine.openinfosecfoundation.org/issues/1202#change-4344<br>> <br>> <br>> <br>> -- <br>> Regards,<br>> Peter Manev<br>> _______________________________________________<br>> Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> Training now available: http://suricata-ids.org/training/<br></div></div> </div></body>
</html>