Re: Pattern Matcher Performance (config detection)

[Mike Lococo <mikelococo () gmail com>]

On 02/24/2011 04:30 PM, Martin Holste wrote:
> Got it, that all agrees with my experiences as well.  So, now I'm
> interested in your report that you got a 30% CPU savings with ac-nq.
> What is your exact config statement?

config detection: search-method ac-nq search-optimize max-pattern-len 20

The only thing that changed between these runs is the search-method.  It
was also running on a live-link which may display minor traffic
variation, and measurements were just done by visually averaging htop
bars over a few minutes.  This wasn't a rigorous benchmark at all.

That said, I reproduced it several times and the difference was fairly
striking.  Again, perfprofiling reports that >80% of the CPU time for
snort is spent in the MPSE due to my very large ruleset, so I may be a
fairly extreme case.

Cheers,
Mike Lococo

------------------------------------------------------------------------------
Free Software Download: Index, Search & Analyze Logs and other IT data in 
Real-Time with Splunk. Collect, index and harness all the fast moving IT data 
generated by your applications, servers and devices whether physical, virtual
or in the cloud. Deliver compliance at lower cost and gain new business 
insights. http://p.sf.net/sfu/splunk-dev2dev 
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users