Re: snort + barnyard + prelude

Hi,

Le vendredi 18 juin 2010 à 17:52 +0100, Sérgio Alves a écrit :
> Hy there prelude users,
> 
> I am having serious performance problems with snort + barnyard + prelude
> in a high traffic testbed:
> 
> Snort + Barnyard are working perfectly well in 'real time'.
> 
> When i run prelude-manager, in the first 10m (+-) the whole system runs
> perfectly fine, i can see it in prewikka and on a reader agent i
> implemented in python(PreludeEasy).
> 
> After 10m(+-) i started to experience some delay on events, and 20m+-
> the it barnyard stop do send events to prelude-manager. It is not a
> problem with barnyard because i can see the events in snort
> base(barnyard exports to snort base).
> 
> I am using openbsd 4.7 and the latest compiled versions of prelude.
> 
> I am runing prelude-manager with the default configurations of the
> scheduler priority, i only put more memory on the buffer (default was 1M).
> 
> What can be the problem?

This might be a problem with the libprelude asynchronous events stack.

One things you could do to verify this would be to edit the
spo_alert_prelude.c file in the Snort sources, and remove the following
code block:

        flags = PRELUDE_CLIENT_FLAGS_ASYNC_SEND|PRELUDE_CLIENT_FLAGS_ASYNC_TIMER;

        ret = prelude_client_set_flags(client, prelude_client_get_flags(client) | flags);
        if ( ret < 0 )
                FatalError("%s: Unable to set asynchronous send and timer: %s.\n",
                           prelude_strsource(ret), prelude_strerror(ret));


After removing the above lines, recompile Snort, and see whether the
issue reproduce. Note that with the above code removed, your Snort
sensor won't be emitting any heartbeat.

Please let us know whether Snort keep sending alerts to Prelude-Manager
after the above code is removed.

Thanks,

-- 
Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
Tel: +33 (0)1 40 24 65 10                      Fax: +33 (0)1 40 24 65 28
http://www.prelude-technologies.com

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user