Appendix B – Resident Memory Consumption

The charts below show the resident memory consumption of all HIDS processes for various systems when an artificially created rate of system call audit records (events) are applied on the system and when certain HIDS templates are running. See Appendix A above for the definition of which templates constitute the “File Templates” and how to measure the event rates on your system.

Memory Consumption on PA Processors

The graphs below show that the memory consumption of HIDS processes stays within 3-4 megabytes as the event load is increased, and in some cases, the memory consumption decreases as the event load is increased.

 

 

 

 

2 Way PA

 

 

30000

 

 

 

 

 

 

 

25000

 

 

 

 

 

 

Events/sec

20000

 

 

 

 

 

All Templates

 

 

 

 

 

 

15000

 

 

 

 

 

File Templates

10000

 

 

 

 

 

RC Template

 

 

 

 

 

 

 

 

 

 

 

 

 

 

5000

 

 

 

 

 

 

 

0

 

 

 

 

 

 

 

0

10000

20000

30000

40000

50000

60000

 

 

 

Resident Memory (KB)

 

 

 

 

 

 

4 Way PA

 

 

30000

 

 

 

 

 

 

 

25000

 

 

 

 

 

 

Events/sec

20000

 

 

 

 

 

All Templates

 

 

 

 

 

 

15000

 

 

 

 

 

File Templates

10000

 

 

 

 

 

RC Template

 

 

 

 

 

 

 

 

 

 

 

 

 

 

5000

 

 

 

 

 

 

 

0

 

 

 

 

 

 

 

41000

42000

43000

44000

45000

46000

47000

 

 

 

Resident Memory (KB)

 

 

HP Company Internal

Page 17 of 20

Page 17
Image 17
HP Host Intrusion Detection System (HIDS) Appendix B Resident Memory Consumption, Memory Consumption on PA Processors