Hi,
around 0200 this morning the swap on one UTM started to increase significantly, going from around 1% to 16%. Please see the attached graph.
Around 0200 my time the avira3 package was installed. I haven't investigated the second bump in swap.
You will note the swap and memory have decreased at the end of the graph, that is because I reduced snort to 1 instance.
Ian
I started using the local database in memory on Sunday (yesterday).