[Snort-users] Performance Question

twig les twigles at ...131...
Thu Feb 19 21:41:12 EST 2004

--- Martin_Bündgens <mb at ...10481...> wrote:
> Hallo,
> i installed Snort 2.01 as SuSE 9 RPM. The programm itself logs
> all rule
> faults in /var/log/snort as complete snort.log + creates for
> all ips an
> extra folder inclusive the fault message as single file from
> the ip.
> My first question, is this a common option that snorts creates
> an extra
> folder for all ips ?
> If not, how to deactivate it.
> Second question, can these tons of folders/files (about
> 2000-5000) can
> effect the server performance ?
> I don`t think so, but one person from our data center insists
> on that the
> "snort" logging process
> is the problem for high loads in combination with logrotate.
> Thanks for your time.
> Regards,
> Martin Bündens

1. This is a default behavior that you can turn off with the -N

2. There are 3 major ways to measure server performance (IMO,
don't fillet me plz): CPU, Memory and disk I/O.  This logging to
disk will hurt you on disk I/O.  Screw around with vmstat and
see if your disk is the biggest bottleneck.  They can take up a
lot of room too and gzipping a 250 meg file on a production box
is no fun either, can peg the CPU some which may be what your
data center buddy is talking about.  If so tell him to renice
the proc for starters.  

I don't personally find this structure to be very helpful but
some people use the info for homegrown shell or perl scripts. 
It's up to you.

With a few exceptions, secrecy is deeply incompatible with
democracy and with science.
     --Carl Sagan  

Do you Yahoo!?
Yahoo! Mail SpamGuard - Read only the mail you want.

More information about the Snort-users mailing list