topic Re: IDS - idscor process in Operating System - HP-UX

IDS - idscor process

Joanne Keegan — Tue, 23 Apr 2002 01:46:26 GMT

HI Everyone,

I'm running IDS on 3 test servers at the moment, and am looking at loading the software on other servers. However, when running top, idscor is using a lot of the resources (95% CPU). Is this normal? I realise that it may be just taking up any free resources.

The question is, how resource hungry is this software, and will it cause significant degradation of response time, etc?

Regards,

Jo

Re: IDS - idscor process

Steven Sim Kok Leong — Tue, 23 Apr 2002 02:01:48 GMT

Hi,

It would be more reliable if you can test it, before the IDS is loaded and after the IDS is loaded.

At the network and transport layers, you can use a tool like iperf which can be downloaded from the following link:

http://dast.nlanr.net/Projects/Iperf/

At the application layer, you have to use application-based tools. An example is tnsping for Oracle. Check whether the RTT from the tnsping to the database increases when the IDS is loaded.

Hope this helps. Regards.

Steven Sim Kok Leong

Re: IDS - idscor process

Joanne Keegan — Tue, 23 Apr 2002 03:03:10 GMT

Thanks Steve for your suggestion. What I was getting at, is if anyone had problems with idscor using large amount of resources. That is, is it normal or a known problem.

We have products such as glance, perfview, etc. So we can get before and after shots.

Regards,

Jo

Re: IDS - idscor process

Pierre Pasturel — Tue, 23 Apr 2002 22:22:22 GMT

>idscor is using a lot of the resources (95% CPU). Is this normal?

This is a known issue when running the race condition or buffer overflow templates.
We will be addressing these performance issues for these templates in a future release.

For all other templates, we have found less than 2% degradation using an I/O intensive benchmark (TPC-C).

If you are running on 11i, you can *prevent* buffer overflow attacks (vs. detection by IDS/9000) by using the execute on stack protection w/o sacrificing performance. See the description of the +es option in the chatr(1) man page.

Pierre