Re: Queue size / log limits, max number of events on 1 packet

Hi, Nathan

Answering your main question, there are other limits which affect on how many logged events you will see.

Particularly, the search engine has its own limits.
You can increase the limit by the following configuration:

search_engine =
{
    max_queue_events = 64
}

event_queue =
{
    max_queue = 64,
    log = 64,
    process_all_events = true
}


Also, you could look at Module's Statistics (to see what's going on). In the following example we see the alert limit set to 20 per each packet:
--------------------------------------------------
Module Statistics
--------------------------------------------------
detection
                 analyzed: 8
               hard_evals: 9
                   alerts: 160
             total_alerts: 160
                   logged: 160
              alert_limit: 20
--------------------------------------------------
search_engine
         qualified_events: 9



Have a nice day ahead,
Alexey

On 12 Feb 2022, at 00:24, Nathan Duval via Snort-users <[email protected]<mailto:[email protected]>> wrote:

I have heard (maybe a long while back now) that snort has a limit on how many rules can fire on a single packet.  I was wondering how accurate this is, and if it is documented somewhere?

I have been trying to test this, but I'm not sure about the results I am seeing, as maybe I am doing something wrong.  I have a small pcap and a large rule set that should fire on the pcap.  It seems that when I run snort, it fires 8 times on a single packet, which I understand to be the default.  If I change the default config though, it seems to have no impact on this.  For example I have this configuration change:

config event_queue: max_queue 20 log 20 order_events content_length

If I comment out the 8 that fired, and run the same pcap again, I find 2 more that had not previously fired.  I guess ideally I would see all 10?  But I am not sure how to enable such a configuration if it is possible to do so.

Thank you

_______________________________________________
Snort-users mailing list
[email protected]<mailto:[email protected]>
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

To unsubscribe, send an email to:
[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette