[Snort-users] CPU usage 100%

Chris Green cmg at ...671...
Tue Jan 29 06:26:09 EST 2002


"Alessandro Fiorenzi" <a.iorenzi at ...2470...> writes:

> Hi, I have installed a snort sensor on a Pentium III 733MHz to monitor 3
> C class traffic, but I see everytime cpu usage 100% is it possible? 
> On this machine I have two processor but snort use only one processor,
> is there any way to use two processor?

To get snort to use 2 cpus, you have to run 2 instances of snort.  It
is not multithreaded.

You might try running 2 class Cs on one snort instance and 1 on the
other and see how it goes.

How much traffic are you seeing?  What is the rough breakdown between
ports/protocols?
-- 
Chris Green <cmg at ...671...>
"Yeah, but you're taking the universe out of context."




More information about the Snort-users mailing list