IDS/9000, Java and CPU

[Alberto Diaz_1]

Hello,

I know that a lot of people have talked about problems related to IDS/9000 GUI and CPU usage. I think that if you are using IDS v2.0 and Java 1.3.1 over HP-UX 11i, you are going to see your CPU getting up to 90% of CPU usage. Is it right or there is anything to do? I am not monitoring buffer overflows or race conditions and IDDS_MODE=3.

Thanks and bye,

Alberto

[Hazem Mahmoud_3 · Accepted solution]

IDS/9000 is a processor hog. The best you can do is to make sure you trim down all the checking that it does. Check the values of the properties of the templates to make sure it's not checking non-critical items. If there is no need to keep the GUI running constantly, then I would close it out. Also take a look at the following links for more information:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=266652

http://www.giac.org/practical/GCUX/Hazem_Mahmoud_GCUX.pdf

-Hazem

[Steven E. Protter]

Alberto,

CPU usage in IDS/9000 is directly related to how much data you are collecting on Intrusions. If you scale that back, CPU use drops back.

Many ships take older servers slated for obsolesence or HP-UX workstations and task them for IDS/9000 server monitoring.

The client should not slow down an average server very much.

SEP

[Alberto Diaz_1]

I know that CPU usage is related to things you are monitoring, but I am not talking about it. I am talking about GUI. I can see a great usage of CPU with idsagent stopped. The proccess is java.

Thanks,

Alberto

[Skand]

Hi Alberto,

The startup of ids/9000 admin GUI *is* quite CPU intensive. The primary culprit for this being the random seed generator in the java.security package. Depending on the system load and the length of the seed bytes it may take from 6sec to >60sec to seed.

However the CPU utilization does come down after the initial hog (from ~90% to ~20%). What is the behaviour that you are observing? Would be in a better position to help you if you can let me know whether the CPU utilisation consistently high or it goes up and down on performing certain actions (such as opening a new window, doing a resync etc.)

Skand.

[Alberto Diaz_1]

Hello,

I can see that CPU usage goes up to 80% when I open a window. Then it goes down to 60% and gets about this level all the time.

Thanks and bye,

Alberto

[Skand]

What is the m/c configuration?
Cheifly: # of processors, memory in the system, model of m/c etc.
Can you also post a sample 'top' output?

Skand.