Snort mailing list archives
what is the difference in memory models (search-method lowmem) mean?
From: Jason Haar <Jason.Haar () trimble co nz>
Date: Mon, 18 Sep 2006 15:11:37 +1200
I have been putting off upgrading our snort network from 2.4X to 2.6 for ages because we run a fairly full ruleset and I saw memory usage leap between the two versions. e.g. I just tried out 2.6.0.2 and our snort installs hit 850MB RAM per process - owch! (under RHE4). This compares with 240MB under 2.4X However, if I enable the line "config detection: search-method lowmem", memory utilization under 2.6 falls waaaaay down to <100MB. Sounds too good to be true. What am I missing out on by doing such an action? And if this sort of memory usage is expected, is everyone just putting in 4G RAM to deal with this sort of thing? Thanks -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- what is the difference in memory models (search-method lowmem) mean? Jason Haar (Sep 17)
- Re: what is the difference in memory models (search-method lowmem) mean? Jason Brvenik (Sep 17)
- Re: what is the difference in memory models (search-method lowmem) mean? Jason Haar (Sep 17)
- Re: what is the difference in memory models (search-method lowmem) mean? Jason Brvenik (Sep 17)