Re: Troubleshooting prelude-manager unresponsiveness

I should probably add that prelude-manager and postgres seem to consume
almost as many resources (CPU, RAM, and disk I/O) when my snorts are running
as when they're not... I guess it's trying to churn through all that queued
data but will it ever catch up?

What is a reasonable number of events per second volume that I should be
able to handle with a single prelude-manager instance? Should I consider
running multiple instances?

Thanks!

--
[ Robert Vineyard | RHCE, Security+ ]    [ [email protected]  ]
[ Information Security Engineer III ]    [ 404.385.6900 | FAX 404.894.4690 ]
[Finding a needle in a haystack isn't hard when every straw is computerized]


Robert Vineyard wrote:
> Now that I've had Prelude up and running for a few days, things have been
> getting gradually slower and slower as I accumulate more data. At this point
> prelude-manager is almost totally unresponsive, and snort sensor startups
> and things like prewikka seem to hang indefinitely when attempting to
> connect to my prelude-manager. Prewikka is reporting that both the manager
> and the sensors are down and is complaining about missing heartbeats for
> several hours.
> 
> Looking in the var/spool directories under my prelude installation, I see
> accumulations of very large (several gigabytes) files on both my snort
> machine and on my prelude-manager machine. I assume this means I'm not
> processing the alerts fast enough in prelude-manager? For what it's worth,
> the spool files are much larger on the prelude-manager side than on the
> snort side. How should I go about troubleshooting this?
> 
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user