Memmory Usage on the sensor has often caused confusion.
The reported Memmory Usage is including both the memmory being used by the IDS processes as well as the memmory that the system has cached for faster file access.
The system tries to cache as much of the available memmory as possible. So memmory usage of 98% is not uncommon.
If the IDS processes need more memmory, then the system just removes that memmory from the cache and hands it over to the IDS processes.
If you think that your sensor is being stressed with the traffic, then their are 2 things to do:
Turn on the 993 alarm.
The 993 alarm monitors for oversubscription of the sensor (the sensor seeing more packets than it can monitor). The 993 is disabled by default and so will need to be enabled.
Keep an eye on the alarm logs during the busiest parts of the day to see if the 993 alarm is firing.
If the 993 alarm is not firing, then the sensor is likely able to handle what it is already monitoring.
Run top to monitor the cpu and memmory usage:
a) Create a service account
b) Login with the service account
c) Switch to user root (same password as service account)
d) Execute "top"
e) Monitor the over all cpu and memmory usage and specifically the usage by the sensorApp process (sensorApp is the process that does the monitoring).
