Eclectic Security

Smooth-sec is built on Ubuntu server 10.04 32bit (www.turnkeylinux.org), this mean the system won’t recognize more than 3GB of memory. An available workaround is to install the PAE (Physical Address Extension), this allow PAE capable processors to access physical memory up to 64 GB (36 bits of address bus). In this how-to, I’m going to show how to install a PAE kernel in order to enjoy Suricata and Snorby at full power. . If you have enough RAM please consider the Suricata High Performance Configuration reported here. It will be very appreciated to receive feedback and comments.

For instance we have Smooth-Sec installed with the default 2.6.32-30-generic kernel on a server with 8GB ram, running a  we can see only 3 of 8GB ram installed.

#free -m

total
Mem: 3072

Now we need to determine if our CPU has PAE support,If the command returns nothing, then the CPU does not have PAE support.

#grep pae /proc/cpuinfo
flags : fpu vme de pse tsc msr pae
flags : fpu vme de pse tsc msr pae

Installing the linux PAE kernel:

#apt-get update

#apt-get install linux-generic-pae linux-headers-generic-pae

and reboot

Check if the correct kernel is loaded.

#uname -a must return 2.6.32-32-generic-pae

Check if the correct amount of RAM is recognised by the system.

#free -m
total
Mem: 8192

Photo by http://www.flickr.com/photos/jepoirrier/