IPS - Performance question - snort status unused and max_queued_bytes ?

Add. I get the following erros as a bonus:

DynamicPlugin: Rule [3:13947] not enabled in configuration, rule will not be used.

WARNING: flowbits key 'file.jar' is checked but not ever set.

Wir sind schon hier gewesen...

https://community.sophos.com/utm-firewall/f/network-protection-firewall-nat-qos-ips/98463/ips-num_instances-performance/357723

https://community.sophos.com/utm-firewall/f/network-protection-firewall-nat-qos-ips/79574/seeing-session-exceeded-configured-max-bytes-to-queue-in-ips-logs

Cheers - Bob

That's right ./ and yes, I do now fully understand the ips num_instances part But I do not fully get the logic with s max_queued_bytes:

1. If I type /var/mdw/scripts/snort status or restart I get status UNUSED ?

2. What's the difference between

cc set ips snortsettings max_queued_bytes

and

cc set ips queue_length

3. Based on what or How to choose the right values ?

My guess is that queue length relates to all IPS activity, not just Snort and that it is the maximum number of items to process.  My guess concerning max_queued_bytes is that it is the maximum size of an item that Snort can consider without breaking the item up and processing it piecemeal.  I haven't seen these in any documentation, but I did follow this community when some developers posted answers occasionally, and those were the things I remember when "reading between the lines."

If you do find definitive answers, please come back here and share.

Cheers - Bob

Thanks for the feedback!