<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><br><div dir="ltr">On 22 Jul 2019, at 08:34, Jeremy A. Grove <<a href="mailto:jgrove@quadrantsec.com">jgrove@quadrantsec.com</a>> wrote:<br><br></div><div dir="ltr"><span></span></div><blockquote type="cite"><div dir="ltr"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Hi All,</div><div><br data-mce-bogus="1"></div><div>I am looking for advice. We are working on setting up a machine for potential 40GB a second on inspection. Our concern comes in the write speed of the I/O to disk as the meta-data that Suricata creates is important to us. Does anyone have experience with this? I have listed some of our set up below. Are there any suggestions or known issues that I should be aware of.</div><div><br data-mce-bogus="1"></div></div></div></blockquote><div><br></div><div>My five cents to start with:</div><div>I would split the logging per event_type and only log what is needed not just everything as some logs depending on the traffic could be very very verbose- like dns/fileinfo on university network etc..</div><div>Also filter out if possible with a bpf(or on the mirror /tap) what is not relevant too.</div><div><br></div><div><br></div><br><blockquote type="cite"><div dir="ltr"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>DL360 Gen 10</div><div>P408I-A (Raid Card)</div><div>4 x 2TB SSD in RAID 10 (Part number 877788-B21) </div><div>Mixed use SSDs</div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Thanks!</div><div><br></div><div data-marker="__SIG_PRE__"><div><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Jeremy Grove, SSCP</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Security Engineer</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Quadrant Information Security</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><br><br></div></div></div></div></blockquote></body></html>