topic Re: IDS/9000, Java and CPU in Operating System - HP-UX

IDS/9000, Java and CPU

Alberto Diaz_1 — Mon, 22 Mar 2004 11:59:35 GMT

Hello,

I know that a lot of people have talked about problems related to IDS/9000 GUI and CPU usage. I think that if you are using IDS v2.0 and Java 1.3.1 over HP-UX 11i, you are going to see your CPU getting up to 90% of CPU usage. Is it right or there is anything to do? I am not monitoring buffer overflows or race conditions and IDDS_MODE=3.

Thanks and bye,

Alberto

Re: IDS/9000, Java and CPU

Hazem Mahmoud_3 — Mon, 22 Mar 2004 12:12:32 GMT

IDS/9000 is a processor hog. The best you can do is to make sure you trim down all the checking that it does. Check the values of the properties of the templates to make sure it's not checking non-critical items. If there is no need to keep the GUI running constantly, then I would close it out. Also take a look at the following links for more information:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=266652

http://www.giac.org/practical/GCUX/Hazem_Mahmoud_GCUX.pdf

-Hazem

Re: IDS/9000, Java and CPU

Steven E. Protter — Mon, 22 Mar 2004 12:20:01 GMT

Alberto,

CPU usage in IDS/9000 is directly related to how much data you are collecting on Intrusions. If you scale that back, CPU use drops back.

Many ships take older servers slated for obsolesence or HP-UX workstations and task them for IDS/9000 server monitoring.

The client should not slow down an average server very much.

SEP

Re: IDS/9000, Java and CPU

Alberto Diaz_1 — Tue, 23 Mar 2004 04:03:18 GMT

I know that CPU usage is related to things you are monitoring, but I am not talking about it. I am talking about GUI. I can see a great usage of CPU with idsagent stopped. The proccess is java.

Thanks,

Alberto

Re: IDS/9000, Java and CPU

Skand — Mon, 29 Mar 2004 02:47:33 GMT

Hi Alberto,

The startup of ids/9000 admin GUI *is* quite CPU intensive. The primary culprit for this being the random seed generator in the java.security package. Depending on the system load and the length of the seed bytes it may take from 6sec to >60sec to seed.

However the CPU utilization does come down after the initial hog (from ~90% to ~20%). What is the behaviour that you are observing? Would be in a better position to help you if you can let me know whether the CPU utilisation consistently high or it goes up and down on performing certain actions (such as opening a new window, doing a resync etc.)

Skand.

Re: IDS/9000, Java and CPU

Alberto Diaz_1 — Mon, 29 Mar 2004 02:58:32 GMT

Hello,

I can see that CPU usage goes up to 80% when I open a window. Then it goes down to 60% and gets about this level all the time.

Thanks and bye,

Alberto

Re: IDS/9000, Java and CPU

Skand — Wed, 31 Mar 2004 08:43:21 GMT

What is the m/c configuration?
Cheifly: # of processors, memory in the system, model of m/c etc.
Can you also post a sample 'top' output?

Skand.