Re: snortreport -- SLOOOW

[Jason Costomiris <jcostom () jasons org>]

On Wed, Aug 29, 2001 at 03:00:22PM -0500, Jacob Killian wrote:
: CPU: 600Mhz AMD Athalon
: Mem: 384M, w/ 512M Swap
: Alerts: 257792 records in the event table (  :~ }  << peevish grin.  Haven't 
: worked on reducing the number of false positives yet -- get alerts for ICMP 
: traffic, etc.  I was hoping to use snortreport to help with that).

Yikes.  Over what time period did you accumulate that number of alerts?
Do you have a lot of false positives in that mix?

: While a report is being run, I get an instance of mysqld running with maximum 
: CPU utilization (it does play nice, but will use 97% if nothing else is 
: running).  Memory utilization is fine (doesn't even use any of the swap 
: space).

That's the behavior I see too.

: I guess I need to work on reducing the number of alerts before I work with 
: snortreport anymore?

You might want to consider some sort of db archival process, unless all
those alerts were generated over a very short time.

: Is there a way to get statistical info from snort 
: (packets processed, packets dropped, alerts triggered, etc)?

I doubt you can get the number of packets processed, since not every packet
is being logged (unless you've specifically told it to do so!).  As for
number of packets dropped, I highly doubt that number's recorded anywhere.
Number of alerts triggered - that's already done by snortreport.

: Who's working ot the SQL optimization?

Chris Adams said he was going to spend some time doing some optimization
on the SQL...

-- 
Jason Costomiris <><           |  Technologist, geek, human.
jcostom {at} jasons {dot} org  |  http://www.jasons.org/ 
          Quidquid latine dictum sit, altum viditur.
                    My account, My opinions.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users