IDS - idscor process

[Joanne Keegan]

HI Everyone,

I'm running IDS on 3 test servers at the moment, and am looking at loading the software on other servers. However, when running top, idscor is using a lot of the resources (95% CPU). Is this normal? I realise that it may be just taking up any free resources.

The question is, how resource hungry is this software, and will it cause significant degradation of response time, etc?

Regards,

Jo

[Steven Sim Kok Leong]

Hi,

It would be more reliable if you can test it, before the IDS is loaded and after the IDS is loaded.

At the network and transport layers, you can use a tool like iperf which can be downloaded from the following link:

http://dast.nlanr.net/Projects/Iperf/

At the application layer, you have to use application-based tools. An example is tnsping for Oracle. Check whether the RTT from the tnsping to the database increases when the IDS is loaded.

Hope this helps. Regards.

Steven Sim Kok Leong

[Joanne Keegan]

Thanks Steve for your suggestion. What I was getting at, is if anyone had problems with idscor using large amount of resources. That is, is it normal or a known problem.

We have products such as glance, perfview, etc. So we can get before and after shots.

Regards,

Jo

[Pierre Pasturel · Accepted solution]

>idscor is using a lot of the resources (95% CPU). Is this normal?

This is a known issue when running the race condition or buffer overflow templates.
We will be addressing these performance issues for these templates in a future release.

For all other templates, we have found less than 2% degradation using an I/O intensive benchmark (TPC-C).

If you are running on 11i, you can *prevent* buffer overflow attacks (vs. detection by IDS/9000) by using the execute on stack protection w/o sacrificing performance. See the description of the +es option in the chatr(1) man page.

Pierre