[Snort-users] what is the difference in memory models (search-method lowmem) mean?

I have been putting off upgrading our snort network from 2.4X to 2.6 for
ages because we run a fairly full ruleset and I saw memory usage leap
between the two versions.

e.g. I just tried out 2.6.0.2 and our snort installs hit 850MB RAM per
process - owch! (under RHE4). This compares with 240MB under 2.4X

However, if I enable the line "config detection: search-method lowmem",
memory utilization under 2.6 falls waaaaay down to <100MB.

Sounds too good to be true. What am I missing out on by doing such an
action? And if this sort of memory usage is expected, is everyone just
putting in 4G RAM to deal with this sort of thing?

Thanks

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users