Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Using snort version 2.8.6, I am attempting to collect application performance stats such as

  • Number of packets not processed due to application overload
  • Percentage of time in processing layers (preprocessor, reassembly, pattern matching, etc)
  • Number of packets processed
  • etc

I am currently using perfmonitor preprocessor to dump performance stats, and graphing some of these values through SNMP calls. The documentation on this preprocessor is fairly limited and doesn't do a good job of explaining what the fields actually mean, or what time frame the figures are calculated over.

To get those kinds of performance metrics, what fields should I be looking at and how are those fields measured?

share|improve this question

migrated from security.stackexchange.com Mar 23 '11 at 20:09

This question came from our site for Information security professionals.

    
you might try sticking a bounty on this one to get some attention. I'm not sure how feasible it is to get some of the stats you are looking for, but there must be a way to get at least some of them. –  Caleb Apr 15 '11 at 10:26
add comment

2 Answers

Right now you have performance 'monitoring' enabled, but you want to enable performance and rule 'profiling'. A performance profile will provide stats on what preproc snort spends its time.

Add the following lines to snort:

config profile_rules: print 100, sort total_ticks, filename /tmp/rules_out
config profile_preprocs: print 10, sort total_ticks, filename /tmp/preproc_out

Let snort run for a while and then when you exit you can see the output files.

For more info please see page 107 of the Snort Manual
(http://www.snort.org/assets/166/snort_manual.pdf)

share|improve this answer
add comment

Suricata is an alternative to Snort, and will actually load up the VRF and EmergingThreat rule sets. It's multithreaded and apparently a lot faster then Snort. My colleague says it has much better Debian packages then Snort does.

Here's a link to the engine statistics you can get from Suricata:

https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Performance_Statistics

There are 2 basic components to Performance Statistics. First, the module actually counts items, such as a stream module counting new streams/sec. Second, is a module that collects all these stats and makes them available to the admin somehow (a log, snmp msg, etc).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.