topic IPS CPU Usage in Network Security https://community.cisco.com/t5/network-security/ips-cpu-usage/m-p/1750963#M56472 <HTML><HEAD></HEAD><BODY><PRE __jive_macro_name="quote" class="jive_text_macro jive_macro_quote">Does the number of enabled signatures have an impact on the CPU usage?<BR /></PRE><P>Short answer: Yes. Long answer: It depends on signatures' status combination, configured Action(s), frequency of being matched, etc.</P><P></P><UL><LI><STRONG>Enabled and Active</STRONG>: Signature consumes both CPU and memory, if matched, configured Action(s) will be taken. Overall, this status has the most potential for resource usage.</LI></UL><P></P><UL><LI><STRONG>Disabled and Active</STRONG>: Signature consumes both CPU and memory, if matched, configured Action(s) will NOT be taken. This status technically will result in less resource usage (variable) since Actions will not have to be generated/taken.</LI></UL><P></P><UL><LI><STRONG>Disabled and Retired</STRONG>: Signature does not consume CPU or memory, and will not be used in inspection towards matching. This status will of course result in the least resource usage.</LI></UL><P></P><P></P><P>Overall, if you are simply testing/troubleshooting, you can Enable/Disable a signature, but if you plan on leaving it Disabled long-term, you should also Retire it to free up resources and improve sensor performance. The act of Retiring (or un-Retiring) a signature is itself a resource-intensive task for the sensor as its match/state tables have to be re-compiled, but once that completes the above status notes apply.</P></BODY></HTML> Tue, 09 Aug 2011 12:35:05 GMT Dustin Ralich 2011-08-09T12:35:05Z IPS CPU Usage https://community.cisco.com/t5/network-security/ips-cpu-usage/m-p/1750962#M56469 <P>Hi,</P><P></P><P>Does the number of enabled signatures have an impact on the CPU usage?</P> Sun, 10 Mar 2019 12:26:27 GMT https://community.cisco.com/t5/network-security/ips-cpu-usage/m-p/1750962#M56469 Bethuelle 2019-03-10T12:26:27Z IPS CPU Usage https://community.cisco.com/t5/network-security/ips-cpu-usage/m-p/1750963#M56472 <HTML><HEAD></HEAD><BODY><PRE __jive_macro_name="quote" class="jive_text_macro jive_macro_quote">Does the number of enabled signatures have an impact on the CPU usage?<BR /></PRE><P>Short answer: Yes. Long answer: It depends on signatures' status combination, configured Action(s), frequency of being matched, etc.</P><P></P><UL><LI><STRONG>Enabled and Active</STRONG>: Signature consumes both CPU and memory, if matched, configured Action(s) will be taken. Overall, this status has the most potential for resource usage.</LI></UL><P></P><UL><LI><STRONG>Disabled and Active</STRONG>: Signature consumes both CPU and memory, if matched, configured Action(s) will NOT be taken. This status technically will result in less resource usage (variable) since Actions will not have to be generated/taken.</LI></UL><P></P><UL><LI><STRONG>Disabled and Retired</STRONG>: Signature does not consume CPU or memory, and will not be used in inspection towards matching. This status will of course result in the least resource usage.</LI></UL><P></P><P></P><P>Overall, if you are simply testing/troubleshooting, you can Enable/Disable a signature, but if you plan on leaving it Disabled long-term, you should also Retire it to free up resources and improve sensor performance. The act of Retiring (or un-Retiring) a signature is itself a resource-intensive task for the sensor as its match/state tables have to be re-compiled, but once that completes the above status notes apply.</P></BODY></HTML> Tue, 09 Aug 2011 12:35:05 GMT https://community.cisco.com/t5/network-security/ips-cpu-usage/m-p/1750963#M56472 Dustin Ralich 2011-08-09T12:35:05Z