on 3-27-2009 3:38 PM Bart Heinsius spake the following: > Nope. I set memory to 256M and tried again. > The following output was taken when downloading a 100MB file. Download speed > was 2MB again. > > top - 23:39:02 up 2 min, 1 user, load average: 0.71, 0.44, 0.18 > Tasks: 52 total, 3 running, 49 sleeping, 0 stopped, 0 zombie > Cpu(s): 22.6%us, 0.7%sy, 0.0%ni, 4.7%id, 0.0%wa, 19.6%hi, 52.5%si, 0.0%st > Mem: 254944k total, 125920k used, 129024k free, 4220k buffers > Swap: 265064k total, 0k used, 265064k free, 43224k cached > > PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND > > > 3506 root 25 0 72804 49m 1156 R 93.6 20.0 0:27.81 snort
Snort is almost maxing out your processor here. You aren't swapping, but there is not enough processor time left to go much higher. You said this is a virtual machine. Can you add more processor and see if it improves? > 1 root 15 0 1504 556 468 S 0.0 0.2 0:00.20 init > > > 2 root 19 -5 0 0 0 S 0.0 0.0 0:00.00 kthreadd > > > 3 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/0 > > > 4 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/0 > > > 5 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/0 > > > > ----- Original Message ----- > From: "Scott Silva" <ssi...@sgvwater.com> > To: efw-user@lists.sourceforge.net > Sent: Friday, March 27, 2009 11:19:34 PM GMT +01:00 Amsterdam / Berlin / Bern > / Rome / Stockholm / Vienna > Subject: Re: [Efw-user] Snort CPU load limits download speed > > on 3-27-2009 3:02 PM Bart Heinsius spake the following: >>> That's a very small amount of ram. Is it using any swap? >> Nope. Top says: >> >> top - 23:01:40 up 31 days, 2:06, 1 user, load average: 0.10, 0.04, 0.01 >> Tasks: 52 total, 2 running, 50 sleeping, 0 stopped, 0 zombie >> Cpu(s): 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, >> 0.0%st >> Mem: 125000k total, 89580k used, 35420k free, 3032k buffers >> Swap: 265064k total, 23460k used, 241604k free, 24452k cached >> >> > OK... When it is at 100% utilization, is it swapping? > > The top output above shows a system that is almost completely asleep. > > Snort does take a lot of processing power, depending on what is happening. It > has to read every packet looking for its patterns. Most systems running snort > probably need at least 512 mb ram if it is serving more than 1 person. I have > seen systems with a large ruleset needing 2 cores and 2 GB of ram to keep up > with a decent data flow. > > > ------------------------------------------------------------------------------ > > _______________________________________________ > Efw-user mailing list > Efw-user@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/efw-user > > ------------------------------------------------------------------------------
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------
_______________________________________________ Efw-user mailing list Efw-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/efw-user
