suricata 6.0.2 - cpu load (idle) rising compared to 5.0.X

suricata 6.0.2 - cpu load (idle) rising compared to 5.0.X

[Matthias Fischer]

[-- Attachment #1: Type: text/plain, Size: 586 bytes --]

Hi,

for the records:

Today I tested 'suricata 6.0.2' and '5.0.6' on Core 153/x86_64.

'suricata' was activated only on RED with a few rules from
"EmergingThreats.net".

Hardware:
https://fireinfo.ipfire.org/profile/5f68a6360ffbecb6877dcac75f5b8c8030f43ce8

*Nothing* has changed here, CPU load still rises from ~0.7% in idle mode
to ~7-9% as soon as 'suricata' is started.

No further mails or reactions in the suricata forum on Michaels last
comment (https://redmine.openinfosecfoundation.org/issues/4096#note-29).

Should I send an update to '5.0.6' or '6.0.2'? ;-)

Best,
Matthias

Re: suricata 6.0.2 - cpu load (idle) rising compared to 5.0.X

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 974 bytes --]

Hello,

> On 2 Mar 2021, at 19:55, Matthias Fischer <matthias.fischer(a)ipfire.org> wrote:
> 
> Hi,
> 
> for the records:
> 
> Today I tested 'suricata 6.0.2' and '5.0.6' on Core 153/x86_64.
> 
> 'suricata' was activated only on RED with a few rules from
> "EmergingThreats.net".
> 
> Hardware:
> https://fireinfo.ipfire.org/profile/5f68a6360ffbecb6877dcac75f5b8c8030f43ce8
> 
> *Nothing* has changed here, CPU load still rises from ~0.7% in idle mode
> to ~7-9% as soon as 'suricata' is started.
> 
> No further mails or reactions in the suricata forum on Michaels last
> comment (https://redmine.openinfosecfoundation.org/issues/4096#note-29).

Yes, that is very sad. I suppose we won’t get anything.

We can only hope that they are going to replace the affected code in Suricata 7. Until then, we are stuck on Suricata 5.

> Should I send an update to '5.0.6' or '6.0.2'? ;-)

Just for 5.0.6, please :)

-Michael

> Best,
> Matthias