[Snort-users] Snort uses 90% of CPU

babu dheen babudheen at ...5176...
Sat Dec 17 01:12:47 EST 2011

Dear All,
       In recent past, we are experiencing high CPU usage on one of Astaro firewall where Snort -IPS functionality is enabled.  Snort almost consumes 90% of the CPU. During such time, we could see only one snort instance used to run and could not find name of the signature which causing high CPU usage and because of this high cpu usage all TCP connection keep getting dropped.  To solve this problem, we had to reboot the Astaro firewall device. Would like to know why snort uses high CPU or in which situation snort can consume more CPU usage.
       Is there any way to find out which signature consumes more CPU in snort during high CPU usage time?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20111217/23e0d33a/attachment.html>

More information about the Snort-users mailing list