[Snort-users] Rule performance profiling question

Andy Berryman aberryman at ...14765...
Wed Sep 15 16:37:51 EDT 2010


Does this mean I should turn off this rule b/c of the amount of checks
and zero alerts for it? 

 

Rule Profile Statistics (worst 100 rules)

==========================================================

   Num      SID GID Rev     Checks   Matches    Alerts
Microsecs  Avg/Check  Avg/Match Avg/Nonmatch

   ===      === === ===     ======   =======    ======
=========  =========  ========= ============

     1     7019   3   5  234171143         0         0
80911378        0.3        0.0          0.3

 

 

 

What about this one? Not as many checks, but it takes a while to check
it each time. 

 

Rule Profile Statistics (worst 100 rules)

==========================================================

Num      SID GID Rev     Checks   Matches    Alerts           Microsecs
Avg/Check  Avg/Match Avg/Nonmatch

==      === === ===     ======   =======    ======           =========
=========  ========= ============

76    14643   3   3      82610         0         0             4949758
59.9        0.0         59.9

 

 

 

Thanks,

Andy Berryman


###############################################################################
This message from Cymtec Systems, Inc. contains confidential information and is solely for the use of the recipient(s) named above.  If you are not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this message in error and that any review, disclosure, copying, distribution or use of the contents of this message is strictly prohibited.  If you have received this message in error, please destroy it immediately and notify Cymtec Systems, Inc. by telephone at +1.314.993.8700 or by return e-mail.                    
###############################################################################
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20100915/b6dd5f5e/attachment.html>


More information about the Snort-users mailing list