It isn't just the IPs.... .3 is using more ram. I am using the local cffd database and ips with two instances. with 3 gigs of ram ram swap usage went from zero to 25%. With a new test configuration for IPS performance testing swap usage is now 50%. this is even with vm.swappiness=0 setup. I'm wondering what the base vm.swappiness will yield in terms of swap usage and performance..[:)]
I suspect some of your issues may be hyper-V related. I have 2.5G allocated to my astaro (up from 2GB for v8) and it doesn't swap with swappiness at 0 (screenshot). Notice the free memory.... that is a mirage I am afraid as it fluctuates drastically for some reason with free memory between 50megs and 400 megs but that behavior hasn't changed since the beginning of the beta. I don't think you should swap at 3GB with a single vcpu (single instance of snort). By the way I am not running IPS due to high cpu loads with the current version.
They have fixed the cssd daemon where a single instance of virus scanner now only takes 129megs instead of 230+ megs. I have noticed that there are a lot more confd instances running in this version compared to v8 but I suspect that will be fixed. Logging into webadmin still spawns too many index.plx processes but that is supposed to be fixed in the next beta release.
Running multiple instances of snort (or different detection methods other than lowmem) will always use more ram and is probably beyond the scope of this discussion.
Regards
Bill
Edit: Just out of curiosity, your hypervisor is not running close to max. capacity? I have noticed strange memory behavior if you allocate almost all the ram specially in ESXi as it starts doing memory compression.
I suspect some of your issues may be hyper-V related. I have 2.5G allocated to my astaro (up from 2GB for v8) and it doesn't swap with swappiness at 0 (screenshot). Notice the free memory.... that is a mirage I am afraid as it fluctuates drastically for some reason with free memory between 50megs and 400 megs but that behavior hasn't changed since the beginning of the beta. I don't think you should swap at 3GB with a single vcpu (single instance of snort). By the way I am not running IPS due to high cpu loads with the current version.
They have fixed the cssd daemon where a single instance of virus scanner now only takes 129megs instead of 230+ megs. I have noticed that there are a lot more confd instances running in this version compared to v8 but I suspect that will be fixed. Logging into webadmin still spawns too many index.plx processes but that is supposed to be fixed in the next beta release.
Running multiple instances of snort (or different detection methods other than lowmem) will always use more ram and is probably beyond the scope of this discussion.
Regards
Bill
Edit: Just out of curiosity, your hypervisor is not running close to max. capacity? I have noticed strange memory behavior if you allocate almost all the ram specially in ESXi as it starts doing memory compression.
I have noticed that there are a lot more confd instances running in this version compared to v8 but I suspect that will be fixed.
Can you explain how you checked this? The usual rule is (roughly explained) that we have one confd worker process per feature. Did you enable more features than in V8?
Logging into webadmin still spawns too many index.plx processes but that is supposed to be fixed in the next beta release.
I don't see this behavior here on 8.930 any more. How do you find out about it, by running top?
