{"id":5861,"date":"2019-01-25T00:04:25","date_gmt":"2019-01-25T00:04:25","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=5861"},"modified":"2019-01-25T01:35:28","modified_gmt":"2019-01-25T01:35:28","slug":"dont-stress-about-a-bit-of-stress-testing-2","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2019\/01\/25\/dont-stress-about-a-bit-of-stress-testing-2\/","title":{"rendered":"Don\u2019t stress about a bit of stress testing #2"},"content":{"rendered":"\n<p>Yesterday I tested <a href=\"https:\/\/www.hexacorn.com\/blog\/2019\/01\/24\/dont-stress-about-a-bit-of-stress-testing\/\">100K Run keys<\/a>, today I test 100K Sysmon rules.<\/p>\n\n\n\n<p>Sysmon is visibly struggling:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" loading=\"lazy\" width=\"394\" height=\"42\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/01\/sysmon_config_100k.png\" alt=\"\" class=\"wp-image-5862\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/01\/sysmon_config_100k.png 394w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/01\/sysmon_config_100k-300x32.png 300w\" sizes=\"(max-width: 394px) 100vw, 394px\" \/><\/figure>\n\n\n\n<p>The CPU goes high, and the logs are not being added. I let it ran for a couple of minutes, but this state has not changed. No idea if it just takes that long to ingest so many rules? So&#8230; not sure if Sysmon has any upper limits for the number of rules, but I guess we can assume it is not 100K, but less. Why? I tried 1K, 10K, and 25K of identical rules and for these numbers sysmon worked pretty well. Once sysmon digested the rules the logs started appearing almost immediately.<\/p>\n\n\n\n<p><strong>Update:<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" loading=\"lazy\" width=\"978\" height=\"114\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/01\/sysmon_config_100k_2.png\" alt=\"\" class=\"wp-image-5864\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/01\/sysmon_config_100k_2.png 978w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/01\/sysmon_config_100k_2-300x35.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/01\/sysmon_config_100k_2-768x90.png 768w\" sizes=\"(max-width: 978px) 100vw, 978px\" \/><\/figure>\n\n\n\n<p>It looks like 100K is definitely a killer number. After ~20 minutes the program bailed out stating that there is not enough memory:<\/p>\n\n\n\n<p>The test was not very methodical, I used a bit of a naughty rule that was testing a presence of a long substring within a string representing an image of each created process. Assuming that sysmon has to test 1K, 10K, 25K, 100K rules on each process, it should affect the processing speed.<\/p>\n\n\n\n<p>It&#8217;s obviously not a biggie, because one needs to modify config to  disrupt the processing so much, but it is good to know that too many rules may not be a very healthy idea. Still, since a typical config won&#8217;t cross 1-5K rules it should work for you like a charm&#8230;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Yesterday I tested 100K Run keys, today I test 100K Sysmon rules. Sysmon is visibly struggling: The CPU goes high, and the logs are not being added. I let it ran for a couple of minutes, but this state has &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2019\/01\/25\/dont-stress-about-a-bit-of-stress-testing-2\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[43,52,58],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5861"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=5861"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5861\/revisions"}],"predecessor-version":[{"id":5867,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5861\/revisions\/5867"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=5861"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=5861"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=5861"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}