Snort Performance Monitoring

Right now you have performance 'monitoring' enabled, but you want to enable performance and rule 'profiling'. A performance profile will provide stats on what preproc snort spends its time.

Add the following lines to snort:

config profile_rules: print 100, sort total_ticks, filename /tmp/rules_out
config profile_preprocs: print 10, sort total_ticks, filename /tmp/preproc_out

Let snort run for a while and then when you exit you can see the output files.

For more info please see page 107 of the Snort Manual
(http://www.snort.org/assets/166/snort_manual.pdf)