Re: Sensor overload - Too much traffic for Snort box?

["Ray H." <snort () melray us>]

I will definitely try the tweaks Benjamin suggested.

As far as monitoring goes, all that I use currently are perfmon stats and
the associated perl script to generate the graphs every hour via cron.

During a one hour graph period that I happened to choose at the time I was
collecting the information to show here, the Mbit per sec graph shows a
minimum of 30 up to 60 Mbit/sec averaging around 40Mbit/sec.

The load average on the snort box never goes crazy after it fully
initializes and reads all the rules, it stays well below 1.0, around 0.15 to
0.4 on average.

Ray H.


-----Original Message-----
From: Fábio a.k.a Fósforo [mailto:fosforo () gmail com] 
Sent: Friday, June 08, 2007 10:59 PM
To: Ray H.
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Sensor overload - Too much traffic for Snort box?

I would recommend to install a network/process monitoring tool like
monit (http://www.tildeslash.com/monit/) or zabbix (i've never tried
it), and like Benjamin Smal propose, see which parameter from /proc to
change after reading the reports.

[]s

On 6/8/07, Ray H. <snort () melray us> wrote:
> Having some trouble with dropped packets. Wondering if my snort box is
under
> powered or if I have my monitor session setup incorrectly, or something
I'm
> just overlooking.
>
> Any help would be greatly appreciated. I've tried to include all relevant
> information pertaining to my issue with dropped packets.


-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users