RE: Help me choose which system to run snort on.

["Jim Hendrick" <jrhendri () maine rr com>]

I'd lean towards the dual processor myself given the number of applications
slated for that one box. Linux is very good at balancing load (even if it
were only running snort, the OS "normal" maintenance processes could take
advantage of the other CPU).

I am currently running 2 snort instances, apache, mysql & acid on a dual 933
linux box w/ 1.5GB RAM and 2x 15K SCSI drives very happily. Most of the time
the CPUs are idle.

The key is memory and fast disks though. Even a dual CPU will need to swap
processes. More memory ==> less often, and faster disks ==> it happens more
quickly.

Think about the orders of speed here:
disks have access times in the ~10ms range (more or less)
memory is *much* faster.


more RAM will help (~2GB) and then if you can go for multiple faster drives
(15K SCSI) to separate the OS and swap, and the database and log files, all
the better.

Good luck!

Jim Hendrick
GCFW, GCIA, GCIH



-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Basselgia,
Barry A Mr (NAF Atsugi)
Sent: Tuesday, November 30, 2004 1:06 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Help me choose which system to run snort on.


I'm building an IDS network, I'll end up with about 6 snort sensors feeding
back to a snort server.

The snort server will be running:

Linux
mysql
apache
snort
barnyard
acid/base
open aanval

There are 2 servers available and I've been given my choice.  Basically, the
servers are the same with regard to memory and hard drives.  The difference
is that one is a dual processor system with 2 x 1 GHz processors and the
other is a single processor system with a 2 GHz processor.

I'm kind of leaning towards the dual processor system, but I wanted to see
if anyone had any suggestions before I made up my mind.

Thanks,
Barry



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users




-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users