3

I am currently running Kali on RPI B. I want to see how well it is resourced in practice as an IDS. I am looking for a reliable method of logging in readable format:

  1. CPU % usage every second
  2. Disk % Writes every second
  3. CPU heat degrees every second
  4. Ram % usage every second
  5. Network % usage every second

I want to get a bench mark of all of these and then have them logging as I enable snort and hit it with some Nessus/nmap/application fuzzer scans etc. I then want to capture the 'attack' at the switch and tcpreplay the attack at a much faster speeds. I hope to achieve some statistics to see where it might bottle neck and how much it can handle, hopefully without causing the board to fry.

  • Doing this every second (especially on a model B+ with only one core and 512MB) would represent a large load all by itself. If you are willing to slow down the sample rate you may want to look into nagios (especially if you can run the server on a different machine and use nrpe on the Pi) You will want to make sure times are synced to make correlating the data easier. You may also want to consider using a third party logging tool like loggly or papertrail and then investigate resource usage through log analysis. This would likely require adding additional details to your logs. – Steve Robillard Mar 13 '15 at 20:53
  • 1
    Having written software that does exactly this, I'm going to disagree with @SteveRobillard -- doing this every second is not a substantial load on any model of pi. Most of it you can get straight from /proc sources, so there is not that much work involved. (Sorry, but I haven't bothered releasing the software partially because I am sure there are other things around that can accomplish the same thing, and partially because I am lazy.) – goldilocks Jan 1 '16 at 13:25
  • @goldilocks but are you throwing automated scans at volume at your box at the same time? – Steve Robillard Jan 1 '16 at 14:05
  • @SteveRobillard Ah, perhaps I misunderstood your point. I was just referring to the stuff before "I enable snort..." – goldilocks Jan 1 '16 at 14:07
1

It's not perfect, but check out htop and syrupy.py, both are available on standard repo. htop is a great visual real-time monitor, while syrupy is for logging. It mostly just shows CPU and memory usage, but these might help get on the right track. They are very lightweight, even at 1s intervals.

  • Where can I find and or install syrupy? I searched on my PI and it didn't find anything that is named syrupy. – ThN Jan 25 '17 at 15:45
  • @DmitryGrigoryev Nope. I just tried and it said no package with that name is found. – ThN Jan 25 '17 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.