Just out of curiosity -- if SIGUSR1 signal is sent to the sec process for creating the dump file (tmp/sec.dump), what does the "Performance statistics" section look like in the dump? Look at the "Run time", "User time", "System time", "Processed input lines" readings -- the figures tell you how many lines per second sec has processed and how much CPU time has been used for this. If these readings are very high, the input needs to be divided somehow between multiple sec instances, or irrelevant events (if there are any) need to be filtered out with some preprocessing tool (e.g., logpp). regards, risto
2011/9/9 Joe Prosser <jvpros...@gmail.com>: > Hi Folks, > I have an extremely busy sec process running with 17675 active > contexts. I'm finding that I need to kill -ABRT the process every > hour or so or else it hogs the CPU and lags in reading the input file. > I know the number of active contexts has been growing, but its been > running for over a year with at least 15k of them. > > Has anyone else had this experience or know what else can be done? > > Cheers, > -Joe > > ------------------------------------------------------------------------------ > Why Cloud-Based Security and Archiving Make Sense > Osterman Research conducted this study that outlines how and why cloud > computing security and archiving is rapidly being adopted across the IT > space for its ease of implementation, lower cost, and increased > reliability. Learn more. http://www.accelacomm.com/jaw/sfnl/114/51425301/ > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------------ Malware Security Report: Protecting Your Business, Customers, and the Bottom Line. Protect your business and customers by understanding the threat from malware and how it can impact your online business. http://www.accelacomm.com/jaw/sfnl/114/51427462/ _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
