<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">How many cores?<br>
<br>
On 3/9/2018 9:48 AM, erik clark wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAK6atxo_MLSzprVP-temOR4hp8pR0YFCVr0W0XOf5rspjALwDQ@mail.gmail.com">
<pre wrap="">So, I am looking at tuning suricata as best as possible on a limited
budget. I am figuring I have about 100 meg throughput possibly, 24-48 gigs
of ram, and ideally would like to run bro on the box as well. Looks like
that may not be sufficient to do this task, and was wondering what kind of
tuning could be done to handle a load of 48 gigs of ram. I also wanted to
shove moloch on there, but I am pretty positive the system cant handle it.
SEPtun2 is clearly out of scope for this. :D
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Suricata IDS Users mailing list: <a class="moz-txt-link-abbreviated" href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a>
Site: <a class="moz-txt-link-freetext" href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a class="moz-txt-link-freetext" href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a>
List: <a class="moz-txt-link-freetext" href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>
Conference: <a class="moz-txt-link-freetext" href="https://suricon.net">https://suricon.net</a>
Trainings: <a class="moz-txt-link-freetext" href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a></pre>
</blockquote>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
Cooper Nelson
Network Security Analyst
UCSD ITS Security Team
<a class="moz-txt-link-abbreviated" href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a> x41042</pre>
</body>
</html>