<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I am using Suricata 3.0 with a big ruleset of 34578 signatures.<div>Depending on a sensor (with some config variations) service start up or reload can take up to 30 minutes.</div><div>I understand that I have big ruleset. Also here is the relative config:</div><div><div>detect-engine:</div><div> - profile: custom</div><div> - custom-values:</div><div> toclient-src-groups: 200</div><div> toclient-dst-groups: 200</div><div> toclient-sp-groups: 200</div><div> toclient-dp-groups: 300</div><div> toserver-src-groups: 200</div><div> toserver-dst-groups: 400</div><div> toserver-sp-groups: 200</div><div> toserver-dp-groups: 250</div><div> - sgh-mpm-context: auto</div><div> - inspection-recursion-limit: 3000</div></div><div><br></div><div>The longest step occurs on </div><div> building signature grouping structure, stage 2: building source address list... complete</div><div><br></div><div>As far as I understand changing values in the above config helps improve CPU usage at the expense of RAM.</div><div><br></div><div>Does anybody know any way to improve performance with such ruleset and without increasing packet loss?</div><div><br></div><div>Thank you.</div> </div></body>
</html>