Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Memory Sensor 4210

We have Sensor 4210 with 512 Mb of memory and the version 4.1 is installed.

The statistic on the sensor shows that we are at 98%.

How much memory can I put in the sensor ( 1 Gb ) ? I don't find it in the documentation.

Thanks

2 REPLIES
Cisco Employee

Re: Memory Sensor 4210

512 Mbps is the maximum supported memory on the sensor.

The 98% usage you see in "show version" is misleading.

This percentage includes both the memory actively being used by the IDS processes, as well as any memory the OS is using for cache recently accessed files.

Unfortunately "show version" doesn't tell you what percent is being used by the IDS processes, and what percent is being used by cache.

It is the percent used by the IDS processes that is of interest for determine sensor problems.

The Eventstore where are alarms are stored on the sensor is a large 4 gig file. This file is accessed everytime IEV or SecMon queries for new alarms, or when sensorApp writes a new alarm. Because it is accessed so often, the OS caches as much of the file as possible into memory. So the OS uses up as much available memory as it can to cache portions of this file.

So even though the sensor reports that 98% of the memory is used it may be that the largest portion of this is just the cache for the eventStore.

In these cases the processes already have more than enough memory, and adding memory would just give the OS a larger area in which to cache the eventStore file.

Because of this a perfectly normal sensor that is not overloaded could still show memory usage at 98%.

So the memory usage currently being reported by show version is not a good gage to determine if something is wrong on the sensor.

If you are experiencing a problem then you should contact the TAC. This way the problem can be diagnosed. Development can then determine that actual memory percentage being used by the IDS processes.

Re: Memory Sensor 4210

What will happen if a sensor has 768mb of RAM?

201
Views
0
Helpful
2
Replies
CreatePlease to create content