[Snort-users] Re: How can I improve ACID Performance

Saad Kadhi bsdguy at ...1472...
Mon Oct 15 09:08:02 EDT 2001


On Mon, 2001-10-15 at 16:33, Steve Halligan wrote:
> >I am no linux expert but I got better
> > performance after tweaking my openbsd kernel & adding some useful
> > options. 
> 
> Do tell what kernel tweaks you made.  How much performance did it get you?
hum I am looking real hard for the "please" or "would you mind" in the
above sentence but can't see any. so let's do *for this time* a
s/Do/please/ & here are the options I have added:
#### CUSTOM OPTIONS
option NMBCLUSTERS=8192
option NKMEMCLUSTERS=8192
option BUFPAGES=8192
option BUFCACHEPERCENT=25
option MAX_KMAP=120
option MAX_KMAPENT=6000
option SEMMNI=256
option SEMMNS=2048
option SHMMAXPGS=4096

I got these options from Henning Bauer
(http://misc.bsws.de/obsdtuning/webserver.txt) & other posts on
misc at ...3814... You may get a look in the archives @
http://marc.theaimsgroup.com + man options(4) for their meaning. The
values depend largely on your system hardware/configuration. But the
above are considered quite safe values. As to the how much performance
it got me, I saw a noticeable difference on the loading time
acid_main.php & other underlying pages when I recompiled the kernel with
the above mentioned options. I didn't make any real measurements of the
performance gain. When I saw that the combination of
MySQL/Snort/Apache/ACID/OpenBSD displayed the alerts faster & allowed me
to delete & archive the alerts faster then I was happy & forgot about
this thing. Anyways, if you are looking for some performance
measurement, get a look at:
http://www.darkcore.net/~wangster/benchmarks/
http://innominate.org/~tgr/slides/performance/img0.htm

HTH & do not forget the please next time mate :)
-- 
/saad
[put your signature here]
self-customize-sig(tm). another dumb patent...
nodisclaimer





More information about the Snort-users mailing list