Closed dougburks closed 4 years ago
The following package is now available at ppa:securityonion/test
:
securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion226
Please test/verify as follows:
start with a 16.04 box with all stable updates applied
run through Setup, choosing Eval Mode
snapshot the VM if possible
add the test PPA:
sudo add-apt-repository -y ppa:securityonion/test
install all updates:
sudo soup -y
Inspired by the comments from https://github.com/Security-Onion-Solutions/securityonion-nsmnow-admin-scripts/pull/28:
After the updated package is installed, you can pin snort processes to specific CPUs by adding a line to the /etc/nsm/HOSTNAME-INTERFACE/sensor.conf
file like:
IDS_LB_CPUS=1,3,5,7
and then (re)starting the Snort process(es) using sudo so-nids-start
or sudo so-nids-restart
.
In the example above, the first four snort processes would be pinned to the first four odd-numbered CPU cores. It validates the input as a number before using it, so if there are more than the specified number (eg 5), any processes without a CPU listed would have the default CPU affinity.
To test, you can move all processes to a specific set of CPUs using systemd's CPUAffinity setting in /etc/systemd/system.conf
and specify values for --cpuset-cpus in the docker containers using the *_OPTIONS values in /etc/nsm/securityonion.conf
. The htop
utility can be useful for verifying that the CPUs not given there are idle. Then, you can test this setting and verify that the processes are moved to the CPUs idled earlier.
You can also verify proper pinning using taskset -p PID
where PID
is the actual process ID of the Snort process you are checking. The default affinity mask is f
, so if pinning is set properly you should see something other than that.
Everything tested good. I used the following command to check the cpu affinity. taskset -cp PID. It gave me the numerical list of processors instead of a bitmask. Just a little easier to read the results.
Tested IDS_LB_PROCS=3 IDS_LB_CPUS=1,3,5 Here each Snort process was pinned to an individual CPU
Tested IDS_LB_PROCS=3 IDS_LB_CPUS=1,3 The Snort-3 process took the default Affinity set in /etc/systemd/system.conf
The settings persisted through a reboot.
Ran so-test - IDS alerts were generated with no errors in logs or dropped packets.
Thanks for testing @bryant-treacle !
https://github.com/Security-Onion-Solutions/securityonion-nsmnow-admin-scripts/pull/28