Re: suricata 6.0.0 / 6.0.1 - cpu load (idle) rising compared to 5.0.4

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 1298 bytes --]

Hey Matthias,

I checked but I cannot confirm this on my machine.

I also asked the others on the telephone conference and nobody saw anything suspicious either.

What hardware are you using, and what rules are you using?

Best,
-Michael

> On 6 Dec 2020, at 11:08, Matthias Fischer <matthias.fischer(a)ipfire.org> wrote:
> 
> Hi,
> 
> I'd like to have a little problem... ;-)
> 
> The other day I saw 'suricata 6.0.0' had its coming out - yesterday it
> was '6.0.1'. At that time I thought it might be a good idea to test the
> current version.
> 
> So I built and tested these two one after another under Core 152/64bit.
> I tested 6.0.0 some days ago, 6.0.1 yesterday. 'libhtp' was updated and
> installed too, yesterday to 0.5.36.
> 
> Both built without problems, both installed without problems, both
> showed a strange behavior while running.
> 
> Under *each* 6.0.X-version, the cpu load for '/usr/bin/suricata -c
> /etc/suricata/suricata.yaml -D -y 0:1' increased in *idle* mode from
> ~0.5%-2.0% to ~12% compared to 'suricata 5.0.4'.
> And I mean it. Idle. Nothing was going on.
> 
> Hardware:
> https://fireinfo.ipfire.org/profile/5f68a6360ffbecb6877dcac75f5b8c8030f43ce8
> 
> Can anyone confirm - or did I miss something?
> 
> Best,
> Matthias