Re: Barnyard2 issue w/unified2 ?

[waldo kitty <wkitty42 () windstream net>]

On 8/15/2013 18:37, John Ives wrote:
> Well the pid is not the issue as each instance of barnyard has a
> different pid file numbered sequentially in the launching script.

my example was simply to give a look at one possible part of the problem...

> It might also be noteworthy to mention that the issue is more obvious
> when I stress test the system by saturating the link. If I reduce the
> amount of traffic, it will generally take longer for it to reoccur.
> Unfortunately, the configuration I am running now is not saturated
> because I have another project that is taking up my time so I haven't
> gone back yet to add more traffic to the link.

as i do not run BY2, i really cannot offer anything more other than the basics i 
have attempted to point out by inference and example... i have attempted to set 
up a multiple detection configuration with a well known appliance package but 
had to withdraw when it stated that 1Gig of RAM per instance was needed and 
we're already performing the basics needed in half that without all the database 
and GUI fluff'n'stuff :/

-- 
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

------------------------------------------------------------------------------
Get 100% visibility into Java/.NET code with AppDynamics Lite!
It's a free troubleshooting tool designed for production.
Get down to code-level detail for bottlenecks, with <2% overhead. 
Download for free and get started troubleshooting in minutes. 
http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!