on 3-27-2009 3:02 PM Bart Heinsius spake the following: >> That's a very small amount of ram. Is it using any swap? > Nope. Top says: > > top - 23:01:40 up 31 days, 2:06, 1 user, load average: 0.10, 0.04, 0.01 > Tasks: 52 total, 2 running, 50 sleeping, 0 stopped, 0 zombie > Cpu(s): 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st > Mem: 125000k total, 89580k used, 35420k free, 3032k buffers > Swap: 265064k total, 23460k used, 241604k free, 24452k cached > > OK... When it is at 100% utilization, is it swapping?
The top output above shows a system that is almost completely asleep. Snort does take a lot of processing power, depending on what is happening. It has to read every packet looking for its patterns. Most systems running snort probably need at least 512 mb ram if it is serving more than 1 person. I have seen systems with a large ruleset needing 2 cores and 2 GB of ram to keep up with a decent data flow.
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------
_______________________________________________ Efw-user mailing list Efw-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/efw-user
