From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: suricata 6.0.0 / 6.0.1 - cpu load (idle) rising compared to 5.0.4
Date: Thu, 10 Dec 2020 14:39:43 +0100
Message-ID: <542D115B-5471-4561-B687-CAEAF21ED900@ipfire.org>
In-Reply-To: <16ab4738-cb8c-b61e-3c3c-cae8ab52757d@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============0813322982229686517=="
List-Id: <development.lists.ipfire.org>

--===============0813322982229686517==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hey Matthias,

I checked but I cannot confirm this on my machine.

I also asked the others on the telephone conference and nobody saw anything s=
uspicious either.

What hardware are you using, and what rules are you using?

Best,
-Michael

> On 6 Dec 2020, at 11:08, Matthias Fischer <matthias.fischer(a)ipfire.org> w=
rote:
>=20
> Hi,
>=20
> I'd like to have a little problem... ;-)
>=20
> The other day I saw 'suricata 6.0.0' had its coming out - yesterday it
> was '6.0.1'. At that time I thought it might be a good idea to test the
> current version.
>=20
> So I built and tested these two one after another under Core 152/64bit.
> I tested 6.0.0 some days ago, 6.0.1 yesterday. 'libhtp' was updated and
> installed too, yesterday to 0.5.36.
>=20
> Both built without problems, both installed without problems, both
> showed a strange behavior while running.
>=20
> Under *each* 6.0.X-version, the cpu load for '/usr/bin/suricata -c
> /etc/suricata/suricata.yaml -D -y 0:1' increased in *idle* mode from
> ~0.5%-2.0% to ~12% compared to 'suricata 5.0.4'.
> And I mean it. Idle. Nothing was going on.
>=20
> Hardware:
> https://fireinfo.ipfire.org/profile/5f68a6360ffbecb6877dcac75f5b8c8030f43ce8
>=20
> Can anyone confirm - or did I miss something?
>=20
> Best,
> Matthias


--===============0813322982229686517==--