Re: [barnyard2-users] Re: Offering a 64bit version of Snort for Windows?

[beenph <beenph () gmail com>]

On Thu, Nov 1, 2012 at 8:17 AM, Michael Steele <michaels () winsnort com> wrote:
> I'll give 2.1.11 a try when it's released. It looks like all I'll need to do
> is add 2048 to the CACHED_MAX_EVENT in the barnyard2.conf.

in 2-1.11 we defaulted the cache size to 2048, (previous default was 256) and
the  new config directive is called  config event_cache_size or command line
option --event-cache-size.

So it would look like the following in barnyard2 config file:
config event_cache_size: 2048

or ./barnyard2 --event-cache-size 2048 ....


If you re-encounter the issue then you might need to grow the cache size.

> The error that is printed will be a warning, and there is no actual problem?

> Do we need to worry about adjusting the CACHED_MAX_EVENT to anything other
> than 2048?

You can allways put a larger number, the only restriction/impact on
the long run is the memory
that the process will use but since this is not pre-allocated,
you could  allways safeguard your self with a larger value.

> Sometimes there are a rapid succession (5-6) of those warnings multiple
> times.

It was related to the issue stated in the previous e-mail amd its
addressed either by
modifying the constant defined in spooler.c in 2-1.10 or using 2-1.11.

-elz

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_sfd2d_oct
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!