Re: Snort use of memory

[Matt Kettler <mkettler () evi-inc com>]

At 10:16 AM 11/1/2004, Larry Wichman wrote:
> I added more memory to one of my Snort boxes but Snort
> does not seem to want to use it. I thought there was a
> doc somewhere that says how to tell Snort to use more
> memory. Can anyone point me to the doc. I looked
> through the archives and FAQs and did not see
> anything.

Erm.. Why do you even want snort to consume more memory?

Snort's not a cached and buffered system. Most things which increase 
snort's memory footprint will generally degrade performance, not improve it.

For example, adding more rules increases memory consumption, but also slows 
things down. Turning on more preprocessors will generally do the same.

About the only thing which consumes more memory but gives you more speed is 
disabling the "lowmem" search option, but that's off by default. (This 
option exists for those who want snort to consume less memory, at the 
expense of increased CPU usage)









-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users