[Snort-users] Can I 'nice' snort process?

Saad Kadhi bsdguy at ...4401...
Thu Jan 10 11:00:04 EST 2002

On Thu, 2002-01-10 at 19:03, Tran, John wrote:
> I'm running snort on one of my web servers as a local IDS (don't ask me why,
> let's just go along w/ it for now..) and it takes up massive amounts of CPU
> (40%), which can be expected considering it's a large amount of traffic.  It
> was suggested to me to run 'nice' on the process to throttle it's CPU usage,
> but I'm pretty sure throttling snort will cause it to drop a lot of packets.
> Is this true?
yep at least to my field knowledge. But instead of nice-ing, you could
log less stuff, tune up your kernel, etc...


/Saad --  [bsdguy at ...4401...] 
[pgp keyid: 35592A6D http://pgp.mit.edu]
# buy a geek-in-a-can, point nozzle at technical problem and spray
# if desesperate degauss your screen. it might solve your pb as well

More information about the Snort-users mailing list