Snort 3 multi-process support

Snort 3 multi-process support is a feature that:

  • associates multiple threads with two Snort instances on Secure Firewall 6160 and 6170 devices running Secure Firewall version 10.0,

  • automatically configures each Snort 3 instance with the threads as required during deployment, and

  • results in reduced memory load, reduced lock contention, and shorter core generation times for improved resiliency, performance, and scalability.

Snort 3 multi-process architecture

Individual Snort 3 instances provide several advantages. Any Snort instance failure results in minimal traffic impact and you can also restart a single Snort process, if required.

Snort threads are distributed over NUMA nodes where each node is considered as an independent processor. This ensures that memory boundaries are maintained. For example, Snort instance 0 uses the memory of node 0, and instance 1 uses the memory of node 1.

The CLI outputs of commands such as show coredump and show perfstats have been enhanced to display information on both the Snort instances. On the Management Center, navigate to Troubleshooting > Monitor > Devices to view the Overview > Critical Processes and the Memory sections for information on both the Snort instances. If there are any rule profiling errors, the Snort instance number is displayed with the error.