{"action":"created","issue":{"url":"https://api.github.com/repos/Security-Onion-Solutions/securityonion-setup/issues/6","repository_url":"https://api.github.com/repos/Security-Onion-Solutions/securityonion-setup","labels_url":"https://api.github.com/repos/Security-Onion-Solutions/securityonion-setup/issues/6/labels{/name}","comments_url":"https://api.github.com/repos/Security-Onion-Solutions/securityonion-setup/issues/6/comments","events_url":"https://api.github.com/repos/Security-Onion-Solutions/securityonion-setup/issues/6/events","html_url":"https://github.com/Security-Onion-Solutions/securityonion-setup/pull/6","id":137607702,"number":6,"title":"sosetup: Production Mode should auto-configure PF_RING instances #735","user":{"login":"weslambert","id":16829864,"avatar_url":"https://avatars.githubusercontent.com/u/16829864?v=3","gravatar_id":"","url":"https://api.github.com/users/weslambert","html_url":"https://github.com/weslambert","followers_url":"https://api.github.com/users/weslambert/followers","following_url":"https://api.github.com/users/weslambert/following{/other_user}","gists_url":"https://api.github.com/users/weslambert/gists{/gist_id}","starred_url":"https://api.github.com/users/weslambert/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/weslambert/subscriptions","organizations_url":"https://api.github.com/users/weslambert/orgs","repos_url":"https://api.github.com/users/weslambert/repos","events_url":"https://api.github.com/users/weslambert/events{/privacy}","received_events_url":"https://api.github.com/users/weslambert/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-01T15:39:56Z","updated_at":"2016-03-01T17:45:22Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/Security-Onion-Solutions/securityonion-setup/pulls/6","html_url":"https://github.com/Security-Onion-Solutions/securityonion-setup/pull/6","diff_url":"https://github.com/Security-Onion-Solutions/securityonion-setup/pull/6.diff","patch_url":"https://github.com/Security-Onion-Solutions/securityonion-setup/pull/6.patch"},"body":"\r\n**** A summary of changes ****\r\n*** In reference to issue #735***\r\n\r\nWhen running sosetup, choosing \"Production Mode\", then \"Best Practices\":\r\n\r\nIDS/Bro processes are automatically configured based on the number of cores.\r\n\r\n**IDS**: $CORES (number of cores)\r\n**Bro**: $HALF_CORES (half the number of cores)\r\n\r\nWhen running sosetup, choosing \"Production Mode\", then \"Custom\":\r\n\r\n**IDS Engine Procs**\r\n\r\nHow many IDS engine processes would you like to run?\r\n\r\nBased on your system's number of cores, it is recommended that you run $CORES IDS engine processes per interface.\r\n\r\nIf you need to change this setting later, change IDS_LB_PROCS in /etc/nsm/HOSTNAME-INTERFACE/sensor.conf\"\r\n\r\n(User selects number of cores)\r\n\r\n**BRO_LB_PROCS**\r\nHow many Bro processes would you like to run?\r\n\r\nThis is limited by the total number of CPU cores on your system,\r\nbut you should probably choose no more than HALF ($HALF_CORES) your number of CPU cores ($CORES).\r\n\r\n(User selects number of cores)\r\n\r\nThanks,\r\nWes"},"comment":{"url":"https://api.github.com/repos/Security-Onion-Solutions/securityonion-setup/issues/comments/190828952","html_url":"https://github.com/Security-Onion-Solutions/securityonion-setup/pull/6#issuecomment-190828952","issue_url":"https://api.github.com/repos/Security-Onion-Solutions/securityonion-setup/issues/6","id":190828952,"user":{"login":"dougburks","id":1659467,"avatar_url":"https://avatars.githubusercontent.com/u/1659467?v=3","gravatar_id":"","url":"https://api.github.com/users/dougburks","html_url":"https://github.com/dougburks","followers_url":"https://api.github.com/users/dougburks/followers","following_url":"https://api.github.com/users/dougburks/following{/other_user}","gists_url":"https://api.github.com/users/dougburks/gists{/gist_id}","starred_url":"https://api.github.com/users/dougburks/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dougburks/subscriptions","organizations_url":"https://api.github.com/users/dougburks/orgs","repos_url":"https://api.github.com/users/dougburks/repos","events_url":"https://api.github.com/users/dougburks/events{/privacy}","received_events_url":"https://api.github.com/users/dougburks/received_events","type":"User","site_admin":false},"created_at":"2016-03-01T17:45:22Z","updated_at":"2016-03-01T17:45:22Z","body":"Hi Wes,\r\n\r\nThanks for the pull request!\r\n\r\nBottom line up front: I think we should go ahead and change IDS to be $HALF_CORES just like Bro to avoid overworking the box.\r\n\r\nMore detail:\r\n\r\nFrom your summary, it sounds like you were faithful to the wording that already exists in Setup.  However, I think we should probably modify the recommendation and, in the case of \"Best Practices\", the value that gets automatically set.  \r\n\r\nWe need to think about dedicating CPU cores to processes so that at some point in the future we can set CPU affinity and keep processes bound to CPU cores and be the only process on the core.\r\n\r\nCPU cores should be dedicated as follows:\r\n1 for OS itself\r\n1 for netsniff-ng\r\nremaining cores split between IDS and Bro (in the case of \"Best Practices\")\r\n\r\nFor example, suppose you have 12 CPU cores:\r\n1 for OS itself\r\n1 for netsniff-ng\r\n5 for IDS\r\n5 for Bro\r\n\r\nIf the user chooses Custom, those additional processes may require additional CPUs, but I think the above may give a good starting point for most users.\r\n\r\nThoughts?"}}