[Snort-users] Snort running at 99% CPU

Devdas Bhagat devdas at ...2348...
Sat Nov 3 23:11:02 EST 2001


On 04/11/01 01:00 -0500, Martin Roesch wrote:
> Ok, if this isn't a FAQ yet it should be.  This happens frequently when
> Snort is setup with MySQL support.  I'm not 100% sure of the reason why
> still, but there is a correlation between 99% CPU utilization on
> Snort+MySQL and Linux.  You might think about trying out barnyard or a
> different database as a solution.
Blake, could you try this on a 2.2.x kernel? I am not sure about this,
but given that I get similar problems with squid on 2.4.x, I think its
not a snort problem but a glibc/kernel problem.
Squid on my system (PIII 600, 1GB ram, 2.4.x any) and snort here both 
show similar problems (gettimeofday()).

Devdas Bhagat




More information about the Snort-users mailing list