Snort mailing list archives
Re: OT: Gentoo users please read
From: Will Metcalf <william.metcalf () gmail com>
Date: Tue, 29 Mar 2011 09:01:20 -0500
CPU pinning, and load balancing based on flow in Luca Deri's PF_RING daq module. @Sourcefire was this ever integrated into the official version of daq? For this to be truly effective though you really need to set affinity on the init process as well otherwise other processes that are spawned will use the affinity mask of the parent process (init) regardless of what you set for your individual snort processes. Regards, Will On Tue, Mar 29, 2011 at 8:47 AM, Jason Wallace <jason.r.wallace () gmail com> wrote:
Howdy, Please forgive the OT post. Most snort users know that many users run multiple instances of snort on a single box. In this type of install it is recommended that each instance be pinned to a specific CPU. The current Gentoo ebuild does not handle creating multiple snort instances or CPU pinning and it is kind of a PITA to setup manually. I have been toying with the idea of re-architecting the ebuild, init scripts and conf.d file to support both multiple instance and optional CPU pinning. This would require a bit of work, so before I go down this road I wanted to get some feedback from the Gentoo Snort community to see if this is something Gentoo users need/want. Would you like to see the Gentoo Snort ebuild, init scripts, and conf.d file natively support setting up multiple instances of Snort with the option to pin instance to a specific CPU? Feel free to respond here (if that is ok with the list moderators) or directly to me. Thx! Wally ------------------------------------------------------------------------------ Enable your software for Intel(R) Active Management Technology to meet the growing manageability and security demands of your customers. Businesses are taking advantage of Intel(R) vPro (TM) technology - will your software be a part of the solution? Download the Intel(R) Manageability Checker today! http://p.sf.net/sfu/intel-dev2devmar _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------ Enable your software for Intel(R) Active Management Technology to meet the growing manageability and security demands of your customers. Businesses are taking advantage of Intel(R) vPro (TM) technology - will your software be a part of the solution? Download the Intel(R) Manageability Checker today! http://p.sf.net/sfu/intel-dev2devmar _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- OT: Gentoo users please read Jason Wallace (Mar 29)
- Re: OT: Gentoo users please read Will Metcalf (Mar 29)
- Re: OT: Gentoo users please read Michael Altizer (Mar 29)
- Re: OT: Gentoo users please read Russ Combs (Mar 29)
- Re: OT: Gentoo users please read Michael Altizer (Mar 29)
- Re: OT: Gentoo users please read Will Metcalf (Mar 29)