===========
Performance
===========

There are several ways to tune the CAPE performance

Processing
==========

"Processing" consists of three steps after the malware is executed in a VM. Those are

* processing of raw data
* signature matching
* reporting

Processing can take up to 30 minutes if the original raw log is large. This is caused by many API calls in that log. Several
steps will iterate through that API list which causes a slowdown. There are several ways to mitigate the impact:

Evented signatures
------------------

Evented signatures have a common loop through the API calls. Use them wherever possible and either switch the
old-style signatures with their api-call loop or convert them to event based signatures

Reporting
---------

Reports that contain the API log will also iterate through the list. De-activate reports you do not need.
For automated environments switching off the html report will be a good choice.

Ram-boost
---------

Ram boost can be switched on in the configuration (in *conf/processing.conf* -> ``ram_boost`` in ``[behavior]``).
This will keep the whole API list in Ram. Do that only if you have plenty of Ram (>20 GB for 8 VMs).
