Output

Snort will print a table much like the following at exit.

Figure 2.1: Rule Profiling Example Output

Configuration line used to print the above table:

config profile_rules: print 4, sort total_ticks

The columns represent:

• Number (rank)
• Sig ID
• Generator ID
• Checks (number of times rule was evaluated after fast pattern match within portgroup or any-$>$any rules)
• Matches (number of times ALL rule options matched, will be high for rules that have no options)
• Alerts (number of alerts generated from this rule)
• CPU Ticks
• Avg Ticks per Check
• Avg Ticks per Match
• Avg Ticks per Nonmatch

Interpreting this info is the key. The Microsecs (or Ticks) column is important because that is the total time spent evaluating a given rule. But, if that rule is causing alerts, it makes sense to leave it alone.

A high Avg/Check is a poor performing rule, that most likely contains PCRE. High Checks and low Avg/Check is usually an any-$>$any rule with few rule options and no content. Quick to check, the few options may or may not match. We are looking at moving some of these into code, especially those with low SIDs.

By default, this information will be printed to the console when Snort exits. You can use the "filename" option in snort.conf to specify a file where this will be written. If "append" is not specified, a new file will be created each time Snort is run. The filenames will have timestamps appended to them. These files will be found in the logging directory.