Re: Troubleshooting prelude-manager unresponsiveness

here is a trick I've used effectively

1) split your sensors across multiple instances of prelude-manager. if 
you have several prelude managers running on the same box on different 
ports using different profiles you can significantly increase your 
insert rate because the database will be able to utilize multiple cores 
for the inserts.
2) have you tuned PostgreSQL yet keep in mind the default configuration 
is tuned for a single CPU box with only 512MB of ram.
3) running VACUUM  ANALYZE often so the planer stats are up to date 
which speeds up the queries.
4) you may want to add some more indexes to optimize some of the more 
common search queries
6) what version of PostgreSQL are you using starting in the 8.3.x series 
the sort algorithms were dramatically enhanced and should make prewikka 
preform significantly faster
5) there are limits to how much history can be in the database schema 
before it slows down some of the queries part of that has to do with the 
fact that at times the queries that prewikka uses to collect the data 
join across up to 8 tables also the queries are really tuned for MySQL 
not PostgreSQL the problem is that the queries that run quickly on 
PostgreSQL will grind MySQL to a halt. i actually wrote a patch that 
increased the speed of prewikka on  postgresql  by over 90% by just 
changing 1 query the problem is that when it was tested on MySQL it 
pegged the CPU at 100% and hours latter still hadn't return the results 
that it could handle reasonably under the unpatched code.

All of that being said on an HP Proliant DL 385 G3 with 8GB of ram, 
Prelude-XLR, and a properly tuned PostgreSQL install I've seen prewikka 
preform very well with over 100,000,000 alerts


Robert Vineyard wrote:
> I should probably add that prelude-manager and postgres seem to consume
> almost as many resources (CPU, RAM, and disk I/O) when my snorts are running
> as when they're not... I guess it's trying to churn through all that queued
> data but will it ever catch up?
>
> What is a reasonable number of events per second volume that I should be
> able to handle with a single prelude-manager instance? Should I consider
> running multiple instances?
>
> Thanks!
>
> --
> [ Robert Vineyard | RHCE, Security+ ]    [ [email protected]  ]
> [ Information Security Engineer III ]    [ 404.385.6900 | FAX 404.894.4690 ]
> [Finding a needle in a haystack isn't hard when every straw is computerized]
>
>
> Robert Vineyard wrote:
>   
>> Now that I've had Prelude up and running for a few days, things have been
>> getting gradually slower and slower as I accumulate more data. At this point
>> prelude-manager is almost totally unresponsive, and snort sensor startups
>> and things like prewikka seem to hang indefinitely when attempting to
>> connect to my prelude-manager. Prewikka is reporting that both the manager
>> and the sensors are down and is complaining about missing heartbeats for
>> several hours.
>>
>> Looking in the var/spool directories under my prelude installation, I see
>> accumulations of very large (several gigabytes) files on both my snort
>> machine and on my prelude-manager machine. I assume this means I'm not
>> processing the alerts fast enough in prelude-manager? For what it's worth,
>> the spool files are much larger on the prelude-manager side than on the
>> snort side. How should I go about troubleshooting this?
>>
>>     
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-ids.org/mailman/listinfo/prelude-user
>   

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user