[Snort-users] Re: ACID / ALERT console browsing issue

adam_peterson at ...10608... adam_peterson at ...10608...
Tue Nov 25 13:34:11 EST 2003

I've had similar issues and tried tweaking everything possible.  The only 
solution was more powerful hardware on the machine running ACID.  I'm not 
sure if that's the case for you but if you're logging the alerts to the 
same machine that's running ACID and you see that it's faster when Snort 
isn't running, I think this is the case.  I moved MySQL and ACID to a dual 
XEON 2ghz with 2gb RAM and it's now faster than I ever thought possible. I 
used to run the same setup on Solaris 8 on a Sunfire V100, faster than 
what you have (I think) and even on that it was intolerably slow.  The 
reason I finally moved everything to the dual XEON machine was because I 
average about 1000 alerts per day globally (5 sensors) and MySQL would 
timeout when I tried deleting more than a couple thousand alerts.  I 
thought MySQL needed to be tweaked but like I said, I tried and tried to 
no avail.  My guess is hardware.

Adam Peterson | Senior WAN Engineer | SPL WorldGroup | 
adam_peterson at ...10608... | +1.415.357.4787

From: Shekar Reddy <shekar.reddy at ...10553...>
To: snort-users at lists.sourceforge.net
Date: Tue, 25 Nov 2003 12:17:15 -0800
Subject: [Snort-users] ACID / ALERT console browsing issue


I'm running SNORT 2.0.4 and ACID on Sun ULTRA 5 workstation with Solaris 9

I'm experiencing SNORT / ACID performance problems on a live network. It
takes more than 120 seconds to move from one page to another while 
ACID console. Just wanted to know how to optimize. It was all OK in a test
environment. It used to take just 2 seconds to load the pages.

Here is SNORT hardware information:

Snort 1 (+ACID +snortcenter) : sun ultra 5 SPARC IIi 360MHz, 512 MB, 10GB
Snort2 sensor : sun ultra 5 SPARC IIi 360MHz, 512 MB, 10GB

Here's one more glitch: snort boxes are in datacenter and I'm trying to
browse ACID console from my work place through my VPN session to 

NOTE: I don't have any VPN latency issues for other applications. We have 
partial DS3 connection at our work place too. 

Here is an important NOTE: When I stop mirroring the traffic, I see
significant browsing performance.

Please let me know what is the bottleneck here. Acid main page itself will
take 120 seconds to download. How can I improve the ACID CONSOLE browsing

NOTE: I haven't tried browsing ACID directly from snort/ACID machine. I'll
try that and post it later. 

Any suggestions are appreciated...

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20031125/99d7e0d3/attachment.html>

More information about the Snort-users mailing list