[Snort-users] Snort running at 99% CPU

Blake Frantz blake at ...319...
Sat Nov 3 16:37:03 EST 2001


strace -p <snort pid> ==

gettimeofday({1004833976, 236288}, NULL) = 0
gettimeofday({1004833976, 241108}, NULL) = 0
gettimeofday({1004833976, 242669}, NULL) = 0
gettimeofday({1004833976, 245542}, NULL) = 0
gettimeofday({1004833976, 250201}, NULL) = 0
gettimeofday({1004833976, 251774}, NULL) = 0
gettimeofday({1004833976, 253326}, NULL) = 0
gettimeofday({1004833976, 258445}, NULL) = 0
gettimeofday({1004833976, 259997}, NULL) = 0
gettimeofday({1004833976, 261560}, NULL) = 0
gettimeofday({1004833976, 267512}, NULL) = 0
gettimeofday({1004833976, 270217}, NULL) = 0
gettimeofday({1004833976, 271981}, NULL) = 0
gettimeofday({1004833976, 276530}, NULL) = 0
gettimeofday({1004833976, 279753}, NULL) = 0
gettimeofday({1004833976, 282675}, NULL) = 0
gettimeofday({1004833976, 284285}, NULL) = 0
gettimeofday({1004833976, 285859}, NULL) = 0
gettimeofday({1004833976, 287759}, NULL) = 0
gettimeofday({1004833976, 299419}, NULL) = 0
gettimeofday({1004833976, 304203}, NULL) = 0
gettimeofday({1004833976, 305739}, NULL) = 0
gettimeofday({1004833976, 307642}, NULL) = 0
gettimeofday({1004833976, 309186}, NULL) = 0

-blake


On Sun, 4 Nov 2001, Chris Keladis wrote:

> Blake Frantz wrote:
> 
> Hi Blake,
> 
>  
> > Snort is consuming 99% CPU on a:
> 
> [..snip..]
> 
> > I was running snort in the same place with a celeron and the CPU never
> > reached 99% (that was snort 1.8.0 (?) I think).  Same compile options.
> 
> 
> Perhaps you could paste a snippet of strace output?
> 
> Something like 'strace -p <pid of snort>'
> 
> Also, are you using the same rules?
> 
> 
> 
> 
> Thanks,
> 
> Chris.
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 





More information about the Snort-users mailing list