Re: Snort running at 99% CPU

[Blake Frantz <blake () mc net>]

strace -p <snort pid> ==

gettimeofday({1004833976, 236288}, NULL) = 0
gettimeofday({1004833976, 241108}, NULL) = 0
gettimeofday({1004833976, 242669}, NULL) = 0
gettimeofday({1004833976, 245542}, NULL) = 0
gettimeofday({1004833976, 250201}, NULL) = 0
gettimeofday({1004833976, 251774}, NULL) = 0
gettimeofday({1004833976, 253326}, NULL) = 0
gettimeofday({1004833976, 258445}, NULL) = 0
gettimeofday({1004833976, 259997}, NULL) = 0
gettimeofday({1004833976, 261560}, NULL) = 0
gettimeofday({1004833976, 267512}, NULL) = 0
gettimeofday({1004833976, 270217}, NULL) = 0
gettimeofday({1004833976, 271981}, NULL) = 0
gettimeofday({1004833976, 276530}, NULL) = 0
gettimeofday({1004833976, 279753}, NULL) = 0
gettimeofday({1004833976, 282675}, NULL) = 0
gettimeofday({1004833976, 284285}, NULL) = 0
gettimeofday({1004833976, 285859}, NULL) = 0
gettimeofday({1004833976, 287759}, NULL) = 0
gettimeofday({1004833976, 299419}, NULL) = 0
gettimeofday({1004833976, 304203}, NULL) = 0
gettimeofday({1004833976, 305739}, NULL) = 0
gettimeofday({1004833976, 307642}, NULL) = 0
gettimeofday({1004833976, 309186}, NULL) = 0

-blake


On Sun, 4 Nov 2001, Chris Keladis wrote:

> Blake Frantz wrote:
>
> Hi Blake,
>
>  
> > Snort is consuming 99% CPU on a:
>
> [..snip..]
>
> > I was running snort in the same place with a celeron and the CPU never
> > reached 99% (that was snort 1.8.0 (?) I think).  Same compile options.
>
>
> Perhaps you could paste a snippet of strace output?
>
> Something like 'strace -p <pid of snort>'
>
> Also, are you using the same rules?
>
>
>
>
> Thanks,
>
> Chris.
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users