Re: [Snort-users] Snort Machines

I would have to disagree. SMP kernel would make better use of two older
processor vs. 1 newer processor, or even two newer processor would be best. The
apps do not make much of a difference, whether they are multi-threaded or not
(but I am assuming that multi-threaded apps make better use of SMP, on the
thread level, not maybe so much on total processor utilization). What utilizes
the SMP is the Kernel (or HAL) and it will divide the processors' time. If the
app is multi-threaded, I'll have to assume the processors are divided by thread,
rather than process (app).

I also must add that Snort with a MySql backend: Multi-processors and MySql make
MySql and much faster beast. I have two older 700MHz processors and I can fill
both up just by deleting a couple hundred thousand alerts.

I guess I would recommend if you have the budget, get two processors, and if
not, get a multi-processor-capable board so you have room to upgrade later if
you need to improve performance.

>Message: 5
>Date: Fri, 14 Nov 2003 16:20:47 -0500
>From: "Stacy J. Brandenburg" <sbranden@redhat.com>
>To: "'snort-users@lists.sourceforge.net'" <snort-users@lists.sourceforge.net>
>Subject: Re: [Snort-users] Snort Machines

> From what I have seen you money is probably better used in getting a
>single proc system with the fastest CPU you can get. Dual CPU's
>depending on the setup/OS/etc does not get you anything if the
>application is not going to make use of it.

>I am running snort on a twin 1.4GHz P3 CPU, Red Hat Enterprise Linux
>2.1AS machine and only one CPU is used for snort. Now I am also pushing
>750Mb/s to it and the second proc is used in handling the interrupts for
>the NIC.

>So it really depends on how you want to use the system.




-------------------------------------------------------
This SF. Net email is sponsored by: GoToMyPC
GoToMyPC is the fast, easy and secure way to access your computer from
any Web browser or wireless device. Click here to Try it Free!
https://www.gotomypc.com/tr/OSDN/AW/...=mm/g22lp.tmpl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users