Snort mailing list archives
Re: Snort use of memory
From: Matt Kettler <mkettler () evi-inc com>
Date: Mon, 01 Nov 2004 15:24:25 -0500
At 10:16 AM 11/1/2004, Larry Wichman wrote:
I added more memory to one of my Snort boxes but Snort does not seem to want to use it. I thought there was a doc somewhere that says how to tell Snort to use more memory. Can anyone point me to the doc. I looked through the archives and FAQs and did not see anything.
Erm.. Why do you even want snort to consume more memory?Snort's not a cached and buffered system. Most things which increase snort's memory footprint will generally degrade performance, not improve it.
For example, adding more rules increases memory consumption, but also slows things down. Turning on more preprocessors will generally do the same.
About the only thing which consumes more memory but gives you more speed is disabling the "lowmem" search option, but that's off by default. (This option exists for those who want snort to consume less memory, at the expense of increased CPU usage)
------------------------------------------------------- This SF.Net email is sponsored by: Sybase ASE Linux Express Edition - download now for FREE LinuxWorld Reader's Choice Award Winner for best database on Linux. http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort use of memory Larry Wichman (Nov 01)
- Re: Snort use of memory Matt Kettler (Nov 01)
- Re: Snort use of memory Alex Butcher, ISC/ISYS (Nov 02)
- Re: Snort use of memory Matt Kettler (Nov 02)
- Re: Snort use of memory Alex Butcher, ISC/ISYS (Nov 02)
- Re: Snort use of memory Matt Kettler (Nov 01)