afcd IS another snort. if hes using the cpu he says he is..the box is underpowered....badly. A bigger box will help if the cpu's are faster(both in raw clock and IPC). Keep in mind that Astaro launches multiple snort processes based on core count...so yeah..he's pounding the box. Try killing p2p/ips(so you turn off all snort processes no matter their name) and see if things don't improve.. dramatically...if they don't then your moving too much data for the cpu/bus systems to keep up with. You're going to need one of the options i listed.
afcd IS another snort. if hes using the cpu he says he is..the box is underpowered....badly. A bigger box will help if the cpu's are faster(both in raw clock and IPC). Keep in mind that Astaro launches multiple snort processes based on core count...so yeah..he's pounding the box. Try killing p2p/ips(so you turn off all snort processes no matter their name) and see if things don't improve.. dramatically...if they don't then your moving too much data for the cpu/bus systems to keep up with. You're going to need one of the options i listed.
