Re: snort performance vs traffic

[Erek Adams <erek () theadamsfamily net>]

On Tue, 9 Jul 2002, Tim Prendergast wrote:

> Curious to see what you are running in comparison to my config, because
> my snort is running out of memory and dying every day during the busy
> hours.
>
> We're pushing like 4 T-1's worth of traffic coming in from the net, not
> to mention the traffic from our internal machines across the 100mb
> switch I am snorting. It's on a box with a 500mhz PIII and 256mb of
> memory. Am I way under-arming this machine for this task?

Tim, it sounds like you're getting bitten by an older bit of code.  IIRC, that
was an issue with an older version but has now been fixed.  If you're not
already, try the 1.8.7 release[0] and see if that helps.

If you're already running it, can you give us some more details on OS and
version, disk systems, etc.?

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Stuff, things, and much much more.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users