[Snort-users] Snort use of memory
mkettler at ...4108...
Mon Nov 1 12:36:34 EST 2004
At 10:16 AM 11/1/2004, Larry Wichman wrote:
>I added more memory to one of my Snort boxes but Snort
>does not seem to want to use it. I thought there was a
>doc somewhere that says how to tell Snort to use more
>memory. Can anyone point me to the doc. I looked
>through the archives and FAQs and did not see
Erm.. Why do you even want snort to consume more memory?
Snort's not a cached and buffered system. Most things which increase
snort's memory footprint will generally degrade performance, not improve it.
For example, adding more rules increases memory consumption, but also slows
things down. Turning on more preprocessors will generally do the same.
About the only thing which consumes more memory but gives you more speed is
disabling the "lowmem" search option, but that's off by default. (This
option exists for those who want snort to consume less memory, at the
expense of increased CPU usage)
More information about the Snort-users