[Snort-users] Performance profiling not working snort 2.8.6

Andy Berryman aberryman at ...14765...
Wed Sep 15 16:15:28 EDT 2010


Thanks for the tip. I found the issue though. Turns out it was the way I
was stopping and starting snort. I wasn't using "kill -SIGHUP
<snort_pid>"

I was just using a convoluted script to kill snort and restart it. 

PID=`ps -elf | grep '\<snort\>' | grep -v grep | grep -v bash | awk
'{print $4}'`;
kill -kill $PID  > /dev/null 2>&1;


Thanks for the tips!
Andy

-----Original Message-----
From: tgiles at ...14981... [mailto:tgiles at ...14981...] 
Sent: Monday, September 13, 2010 12:07 PM
To: Andy Berryman
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Performance profiling not working snort 2.8.6

Try adding "--perfmon-file /tmp/snort.perfmon.csv" at the end of your
command line. for example, this is the commandline I have for one of my
systems:

/opt/snort/bin/snort -i eth3 -c /opt/snort/etc/snort.conf -D -F
/opt/snort/excludes.conf --perfmon-file
/opt/snort/snort.perfmon.eth3.csv

Cheers,

tom


-----Original Message-----
From: "Andy Berryman" <aberryman at ...14765...>
Sent: Monday, September 13, 2010 11:49am
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Performance profiling not working snort 2.8.6

------------------------------------------------------------------------
------
Start uncovering the many advantages of virtual appliances and start
using them to simplify application deployment and accelerate your shift
to cloud computing http://p.sf.net/sfu/novell-sfdev2dev
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-usersI have
performance profiling turned on and am trying to some diagnostics. But
no file is being created when snort restarts and the preprocessors
aren't being profiled. The only thing that is working is the
"preprocessor perfmonitor:"

 

This is the options we've compiled snort with. 

--enable-decoder-preprocessor-rules --enable-dynamicplugin
--enable-perfprofiling --enable-gre --enable-timestats
--enable-linux-smp-stats --enable-targetbased --enable-corefiles

 

Here's my snort.conf:

 

config profile_preprocs

config profile_rules: print 100, sort total_ticks, filename
/var/log/perf.txt

preprocessor perfmonitor: \

time 30 events flow max console pktcnt 10000

 

Thanks,

Andy Berryman


########################################################################
#######
This message from Cymtec Systems, Inc. contains confidential information
and is solely for the use of the recipient(s) named above.  If you are
not the intended recipient or an agent responsible for delivering it to
the intended recipient, you are hereby notified that you have received
this message in error and that any review, disclosure, copying,
distribution or use of the contents of this message is strictly
prohibited.  If you have received this message in error, please destroy
it immediately and notify Cymtec Systems, Inc. by telephone at
+1.314.993.8700 or by return e-mail.                    
########################################################################
#######



------------------------------------------------------------------------
------
Start uncovering the many advantages of virtual appliances and start
using them to simplify application deployment and accelerate your shift
to cloud computing http://p.sf.net/sfu/novell-sfdev2dev
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
###############################################################################
This message from Cymtec Systems, Inc. contains confidential information and is solely for the use of the recipient(s) named above.  If you are not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this message in error and that any review, disclosure, copying, distribution or use of the contents of this message is strictly prohibited.  If you have received this message in error, please destroy it immediately and notify Cymtec Systems, Inc. by telephone at +1.314.993.8700 or by return e-mail.                    
###############################################################################




More information about the Snort-users mailing list