Suricata - Engine?

[ruggerio]

Hi,

When testing 20.7 from iso, i always used Aho Ken Steele, no problems with memory.

Now, in 20.7 Production, memory goes up nearly 70% for suricata and the system is swapping. This was not the case before. I changed for now to "reduced memory implementation", but still lots of memory used and swap.

thx!
Ruggerio

[XeroX]

What happens when you set it to "ac"?

No intel processor?

[ruggerio]

ac? aho-corasick? Memory full, as in Ken Steele Variant. I just set IDP, no IPS.

No, it's a apu4 with a 4-core AMD Jaguar. Hyperscan in that case is no alternative.

Ruggerio

[hushcoden]

I'm actually running Hyperscan with my AMD GX-412TC and it works, so far so good...

[spetrillo]

Anyone seeing the "loading" on the Rules tab and it never goes away?

[aesth]

Anyone seeing the "loading" on the Rules tab and it never goes away?

I was going to say: "yes now that you mentioned it". But it finished loading after I logged in, that took a while.