[Snort-users] Snort use of memory

Matt Kettler mkettler at ...4108...
Mon Nov 1 12:36:34 EST 2004


At 10:16 AM 11/1/2004, Larry Wichman wrote:
>I added more memory to one of my Snort boxes but Snort
>does not seem to want to use it. I thought there was a
>doc somewhere that says how to tell Snort to use more
>memory. Can anyone point me to the doc. I looked
>through the archives and FAQs and did not see
>anything.

Erm.. Why do you even want snort to consume more memory?

Snort's not a cached and buffered system. Most things which increase 
snort's memory footprint will generally degrade performance, not improve it.

For example, adding more rules increases memory consumption, but also slows 
things down. Turning on more preprocessors will generally do the same.

About the only thing which consumes more memory but gives you more speed is 
disabling the "lowmem" search option, but that's off by default. (This 
option exists for those who want snort to consume less memory, at the 
expense of increased CPU usage)











More information about the Snort-users mailing list