Would it be correct to say the higher we can increase the size-trigger 'megabytes' value, the better filtering results (accuracy) we will achieve? In other words, would it be beneficial for us to purchase more memory on our server (say an additional 2GB), then increase the 'megabytes' value to 400 or 800?
Several of our servers are hitting the upper limit (159,383,552) 150 MB Thanks, --Paul -----Original Message----- From: Message Sniffer Community [mailto:[EMAIL PROTECTED] Behalf Of Pete McNeil Sent: Wednesday, July 30, 2008 8:23 AM To: Message Sniffer Community Subject: [sniffer] Re: FW: Memory Usage of MessageSniffer 3 Hello Ian, The new (V3) SNF does use more ram than the old SNF (V2). GBUdb adds records over time as it learns new IP data. The amount of RAM that will be used by GBUdb depends on how quickly it is learning new IPs and how frequently the database is condensed. You can set an upper limit on the size of GBUdb in the configuration file: <condense minimum-seconds-between='600'> <time-trigger on-off='on' seconds='86400'/> <posts-trigger on-off='off' posts='1200000'/> <records-trigger on-off='off' records='600000'/> <size-trigger on-off='on' megabytes='150'/> </condense> By default GBUdb will condense once per day or when it reaches 150 MBytes. Roughly twice as much RAM is needed for the condensing process since the GBUdb data must be copied to a new location. Condensing the GBUdb data is relatively expensive, so if sufficient RAM is not released by the first pass GBUdb will condense again every 10 minutes (600 seconds above) until GBUdb is below the size limit you have set. I recommend you determine how much ram you want to make available for SNF and then set your <size-trigger/> to 40% of that size. This should leave room for GBUdb to condense and for the rest of SNF to fit inside your memory limit. You can monitor your GBUdb status in your status.minute or status.second reports. Here is some sample data from one of our spamtrap processors. It has been stable for months so this should be indicative of what you would see on a busy machine that's been up for a while: <gbudb> <size bytes="142606336"/> <records count="650314"/> <utilization percent="95.8431"/> </gbudb> For information on reading your status reports: http://www.armresearch.com/support/articles/software/snfServer/logFiles/stat usLogs.jsp Hope this helps, _M Tuesday, July 29, 2008, 10:31:23 PM, you wrote: > This is from one of our engineers. Anybody else had this sort of issue? > Ian > -----Original Message----- > Does the new sniffer stuff have a higher memory requirement than > the old? Sebastian pointed out to me today that a number of our > gate servers were using a ton of swap space. Restarting snfctrl frees up a few hundred megs. > Our newer gate servers (all with 2 or more GB of RAM) seem to be > doing alright, but we have 16 gates at IAD with 1 GB of RAM that are > being affected by this. It looks like the memory usage increases > progressively over the course of a couple days, so I don't know if > it's a memory leak or what. Is there anything we should do or add a > snfctrl restart to our nightly cron jobs and just live with it for now? > ############################################################# > This message is sent to you because you are subscribed to > the mailing list <sniffer@sortmonster.com>. > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> > To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> > To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> > Send administrative queries to <[EMAIL PROTECTED]> -- Pete McNeil Chief Scientist, Arm Research Labs, LLC. ############################################################# This message is sent to you because you are subscribed to the mailing list <sniffer@sortmonster.com>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]> ############################################################# This message is sent to you because you are subscribed to the mailing list <sniffer@sortmonster.com>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
