Snort mailing list archives
Re: Performance profiling not working snort 2.8.6
From: tgiles () echoforest org
Date: Mon, 13 Sep 2010 12:06:30 -0500 (CDT)
Try adding "--perfmon-file /tmp/snort.perfmon.csv" at the end of your command line. for example, this is the commandline I have for one of my systems: /opt/snort/bin/snort -i eth3 -c /opt/snort/etc/snort.conf -D -F /opt/snort/excludes.conf --perfmon-file /opt/snort/snort.perfmon.eth3.csv Cheers, tom -----Original Message----- From: "Andy Berryman" <aberryman () Cymtec com> Sent: Monday, September 13, 2010 11:49am To: snort-users () lists sourceforge net Subject: [Snort-users] Performance profiling not working snort 2.8.6 ------------------------------------------------------------------------------ Start uncovering the many advantages of virtual appliances and start using them to simplify application deployment and accelerate your shift to cloud computing http://p.sf.net/sfu/novell-sfdev2dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-usersI have performance profiling turned on and am trying to some diagnostics. But no file is being created when snort restarts and the preprocessors aren't being profiled. The only thing that is working is the "preprocessor perfmonitor:" This is the options we've compiled snort with. --enable-decoder-preprocessor-rules --enable-dynamicplugin --enable-perfprofiling --enable-gre --enable-timestats --enable-linux-smp-stats --enable-targetbased --enable-corefiles Here's my snort.conf: config profile_preprocs config profile_rules: print 100, sort total_ticks, filename /var/log/perf.txt preprocessor perfmonitor: \ time 30 events flow max console pktcnt 10000 Thanks, Andy Berryman ############################################################################### This message from Cymtec Systems, Inc. contains confidential information and is solely for the use of the recipient(s) named above. If you are not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this message in error and that any review, disclosure, copying, distribution or use of the contents of this message is strictly prohibited. If you have received this message in error, please destroy it immediately and notify Cymtec Systems, Inc. by telephone at +1.314.993.8700 or by return e-mail. ############################################################################### ------------------------------------------------------------------------------ Start uncovering the many advantages of virtual appliances and start using them to simplify application deployment and accelerate your shift to cloud computing http://p.sf.net/sfu/novell-sfdev2dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Performance profiling not working snort 2.8.6 Andy Berryman (Sep 13)
- Re: Performance profiling not working snort 2.8.6 Joel Esler (Sep 13)
- Re: Performance profiling not working snort 2.8.6 Andy Berryman (Sep 13)
- Re: Performance profiling not working snort 2.8.6 tgiles (Sep 13)
- Re: Performance profiling not working snort 2.8.6 Andy Berryman (Sep 15)
- Re: Performance profiling not working snort 2.8.6 Joel Esler (Sep 13)