<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Thanks to both Peter and Cooper! </div><div><br data-mce-bogus="1"></div><div>I do split out by event type already and I can certainly trim out some of this if needed. Ill let you know how it goes.</div><div><br data-mce-bogus="1"></div><div>Regards,</div><div><br></div><div data-marker="__SIG_PRE__"><div><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Jeremy Grove, SSCP</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Security Engineer</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Quadrant Information Security</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">o: </span><span class="Object" id="OBJ_PREFIX_DWT146_com_zimbra_phone" style="color: #005a95; cursor: pointer; font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><a href="callto:(904)296-9100" style="color: #005a95; text-decoration: none; cursor: pointer;" target="_blank">(904)296-9100</a></span><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"> x100</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">t: </span><span class="Object" id="OBJ_PREFIX_DWT147_com_zimbra_phone" style="color: #005a95; cursor: pointer; font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><a href="callto:(800) 538-9357" style="color: #005a95; text-decoration: none; cursor: pointer;" target="_blank">(800) 538-9357</a></span><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"> x100</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">e:</span><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"> </span><span class="Object" id="OBJ_PREFIX_DWT148_ZmEmailObjectHandler" style="color: #005a95; cursor: pointer; font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><a class="moz-txt-link-abbreviated" href="mailto:soc@quadrantsec.com" target="_blank" style="color: #005a95; text-decoration: none; cursor: pointer;">soc@quadrantsec.com</a></span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Learn more= about our managed SIEM <span class="Object" id="OBJ_PREFIX_DWT149_com_zimbra_url" style="color: #005a95; cursor: pointer;"><a href="https://a.quadrantsec.com/3D%22https://quadrantsec.com/SaganMSSP%22" target="_blank" style="color: #005a95; text-decoration: none; cursor: pointer;">people + product</a></span></span><br><br><br></div></div><div><br></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>From: </b>"Peter Manev" <petermanev@gmail.com><br><b>To: </b>"Jeremy A. Grove" <jgrove@quadrantsec.com><br><b>Cc: </b>"oisf-users" <oisf-users@lists.openinfosecfoundation.org><br><b>Sent: </b>Monday, July 22, 2019 11:13:46 AM<br><b>Subject: </b>Re: [Oisf-users] 40GB inspection and I/O write speed concerns<br></div><div><br></div><div data-marker="__QUOTED_TEXT__"><br><div dir="ltr">On 22 Jul 2019, at 08:34, Jeremy A. Grove <<a href="mailto:jgrove@quadrantsec.com" target="_blank">jgrove@quadrantsec.com</a>> wrote:<br><br></div><div dir="ltr"><span></span></div><blockquote><div dir="ltr"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Hi All,</div><br><div>I am looking for advice. We are working on setting up a machine for potential 40GB a second on inspection. Our concern comes in the write speed of the I/O to disk as the meta-data that Suricata creates is important to us. Does anyone have experience with this? I have listed some of our set up below. Are there any suggestions or known issues that I should be aware of.</div><br></div></div></blockquote><br><div>My five cents to start with:</div><div>I would split the logging per event_type and only log what is needed not just everything as some logs depending on the traffic could be very very verbose- like dns/fileinfo on university network etc..</div><div>Also filter out if possible with a bpf(or on the mirror /tap) what is not relevant too.</div><br><br><br><blockquote><div dir="ltr"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>DL360 Gen 10</div><div>P408I-A (Raid Card)</div><div>4 x 2TB SSD in RAID 10 (Part number 877788-B21) </div><div>Mixed use SSDs</div><br><br><div>Thanks!</div><br><div><div><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Jeremy Grove, SSCP</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Security Engineer</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Quadrant Information Security</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"></div></div></div></div></blockquote><br></div></div></body></html>