EAP 2 - Ram Utilisation

shred said:

How come you're limited to 6GB usable? I'm on a Sophos XG Home license as well but with EAP, I'm able to utilize all 8GB.

By default the Home License is limited to 6GB of ram, but apparently on EAP there's no RAM or CPU Limit, since i has able to use 8C/16GB on a VM.

shred said:

How do you enable hyperscan?

If you have a Intel CPU and Intel NIC, you can enable it by running: "set ips search-method hyperscan" In the XG Console.

And then check if it has enable with: "show ips-settings"

There has a noticeable performance improvement with it, and also an huge RAM usage decreased by Snort. Which are both expected with Hyperscan.

Thanks. Mine was defaulted to the "search_method ac-q". I enabled hyperscan and my RAM utilization dropped from 48% to now 35% (also running 8GB of RAM).

From memory if you used the upgrade from v17 memory cap changed, but if like me you did rebuilds using the ISOs the home licence memory cap remained at 6gb.

Ian

What are the trade-offs for using hyper scan?

Ian

Ian,

more info can be found here.

http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node16.html

In the link, search for "search-method"

Regards

rfcat_vk said:

What are the trade-offs for using hyper scan?

There's no trade-offs,

Hyperscan have a lower memory footprint and higher performance, if implemented correctly with Snort you could see almost 6x higher performance with it. And using at the same time 1/3 of the memory.

But i'm not seeing that huge difference with XG. I'll take this weekend to test the actual difference.

Here's a good read on it.

nice, ram usage dropped from 76% (of 4GB) to 57%

Memory dropped immediately to 49% then rose to 60%.

So, no great improvement, but 10% is better then nothing.

The load has increased slightly. So monitoring over the next couple of days.

Ian

I do not get why using less than 75% memory is such a problem.  

Seriously, who cares ?

I’m far more concerned about real life Firewall responsiveness than a race to use as least memory as possible .

Paul Jr

Because spare memory is used to cache, less disk access, faster user response, less swap especially on slower machines.

As we have seen 4gb systems were having issues so greducing memory use when you are limited to 4 or 6gb is worth the effort.

Ian