Snort mailing list archives
Re: Can I 'nice' snort process?
From: Saad Kadhi <bsdguy () docisland org>
Date: 10 Jan 2002 19:58:21 +0100
On Thu, 2002-01-10 at 19:03, Tran, John wrote:
I'm running snort on one of my web servers as a local IDS (don't ask me why, let's just go along w/ it for now..) and it takes up massive amounts of CPU (40%), which can be expected considering it's a large amount of traffic. It was suggested to me to run 'nice' on the process to throttle it's CPU usage, but I'm pretty sure throttling snort will cause it to drop a lot of packets. Is this true?
yep at least to my field knowledge. But instead of nice-ing, you could log less stuff, tune up your kernel, etc... regards. -- /Saad -- [bsdguy () docisland org] [pgp keyid: 35592A6D http://pgp.mit.edu] # buy a geek-in-a-can, point nozzle at technical problem and spray # if desesperate degauss your screen. it might solve your pb as well _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Can I 'nice' snort process? Tran, John (Jan 10)
- Re: Can I 'nice' snort process? Saad Kadhi (Jan 10)
- Re: Can I 'nice' snort process? D.Rajesh Kumar (Jan 10)
- Re: Can I 'nice' snort process? Kris Kennaway (Jan 10)
- Re: Can I 'nice' snort process? Frank (Jan 10)
- <Possible follow-ups>
- RE: Can I 'nice' snort process? Saad Kadhi (Jan 10)
- Re: Can I 'nice' snort process? Saad Kadhi (Jan 10)