Intrusion Prevention (IPS) high cpu usage - Snort

Thanks very much, you solved the perfomance issue, sophos should add quick help there (Grayed out examples)

if the ^ matches till the first /, would be the ? at end not be useless?

And at end u wrote ^.*\.sophosxl\.net/ , would be it not be more like ^*\.sophosxl\.net/ 

If i got right with ^.*\.sophosxl\.net/  it would search after aaaaaaaaaaaaaaaaaaaaaaa.sophosx.l.net and evry other combination, instead cutting of the string at beginngen and match only the end part.

Thanks for the clarification that snort is much more. I just rejeceted your answer because support is not always the way to go.

I tried it with support and it was horrible expierence. I dont speak english on daily basis, but have no problem reading/writing or watching videos, but the phone quality with my the two supporter people was horrible. The first guy just started a logging process, and said call them back later if it happens again. The secound basically just checked evrything is running and checked most common problems to the topic, which i could find on the forum.

After that he send whole putty log over to the senior engineer, who looked more deeply but also suggested a fast wimp like disabling ips and adding on web exception \ before a dot  (Even if i had it on all exceptions).

We also see this problem since the migration from v18.5.2 to v19.0.1.

Here there are spikes up to 95% of Snort, incl. garner problem since upgrade.
[garner] konstant 30% CPU, resolve Cache error


A solution should be found quickly here.
Latency-critical applications like VoIP already have their problems here, even from 80% CPU load of the FW.

When we first saw customers having performance problems with exceptions and tls exclusions I wrote KB-000043654 with the catchy title "Sophos Firewall: Exclude a website from TLS inspection" to explain the performance impacts.  The focus was on how to exclude, not how to diagnose performance issues.  When I have some spare time I am trying to write a new article that will have some of the same information but specifically about (and titled) high cpu in snort.  Right now I am working on collecting several different causes that have come through escalations.  Question: should I include the "why", such as the examples I wrote above?  Usually KB are more about the answer ("write all your regex in this style") then explaining why the answer is correct.

You are correct about the teamviewer example.  I had just cut and paste it out the XG without thinking about it.  Offhand I do not know why we wrote it like that, It might be that some teamviewer things do weird but valid stuff like server.teamviewer.com:80/foobar.  I would agree that newly written ones should not have an ending ? (which makes the slash optional).  The Microsoft example is a better one.

Sophos maintains several different servers and subdomains, such as gw.sophosxl.net primary.wing.sophosxl.net.  The RegEx as written will match all subdomains but not the main domain (where we never have a server).

To parse the regex I used in the example.

^.*\.sophosxl

^ matches the beginning of string
.  matches any character
* means the preceding thing can match zero-to-many times
\ next character is a literal
. is a literal period if there was a slash (or any character if no slash)

So...
^ beginning of string
.* any number of any character (including slashes)
\. literal period

^*\. is what you asked about, which is "any number of beginning of string" which is not what you want.

The actual RegEx we use is
^[A-Za-z0-9.-]*\.sophosxl

^ beginning of string
[A-Za-z0-9.-]* any number of any valid fqdn character (not including slashes)
\. literal period (not optional)