argus-2.0.0 tuning

[Carter Bullard]

Gentle people,
   Argus-2.0.0 seems to be doing OK, the only real
issue has been in DDOS attacks, where it can get
overwhelmed.  I have had some good luck with changing
some internal variables, and removing a syslog() call
in the code, and so tuning definitely has its benefits.
 
   Default 2.0.0 is configured for a maximum record output
of 1024 records per second, and have a buffer capacity of
8 seconds. With an average record size of 128 bytes,
this is just 1Mbps (128KB) of output that Argus can
generate.  This seems tooooooo low.

   We should engineer for a target max output bit rate
for argus.  Do numbers like 10-20Mbps seem reasonable?
Based on your logs, what kind of argus load are you
generating?   What's the best IDE throughput for writing?

Thanks!!

Carter


Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter at qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20010404/bd8e9ab0/attachment.html>