From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: suricata 6.0.0 / 6.0.1 - cpu load (idle) rising compared to 5.0.4
Date: Mon, 14 Dec 2020 15:26:28 +0100
Message-ID: <FC4A9EE6-FC32-4396-9AE3-82381C3AC9F6@ipfire.org>
In-Reply-To: <H000007e004e3c70.1607735884.mail.at4b.com@MHS>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============6286063783608646226=="
List-Id: <development.lists.ipfire.org>

--===============6286063783608646226==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hi,

> On 12 Dec 2020, at 02:18, Kienker, Fred <fkienker(a)at4b.com> wrote:
>=20
> Matthas:
>=20
> I worked through some of the examples of the settings described in the=20
> Suricata forum discussion. If my observations is correct, the issue=20
> centers around the flow manager. A change to it has made a big=20
> difference it the resource usage by this process. Its likely going to=20
> come down to live with the load created the v6 version or revert to v5=20
> and wait for them to get to the bottom of this. No combination of=20
> settings in the flow section of suricata.yaml ever seemed to reduce it=20
> and instead increased it.

Good research.

> I don't use low power systems for IPFire and dont have access to one=20
> but others with these systems may want to take a look at their=20
> performance numbers and report back as to whether they can live with the=20
> higher load.

It is not directly low-power systems.

I launched this on AWS today and the CPU load is immediately at 25%. It was m=
entioned on the linked thread that virtual systems are affected more.

I would now rather lean towards reverting suricata 6 unless there is a hot fi=
x available soon.

Best,
-Michael

>=20
> Best regards,=20
> Fred
>=20
> Please note: Although we may sometimes respond to email, text and phone=20
> calls instantly at all hours of the day, our regular business hours are=20
> 9:00 AM - 6:00 PM ET, Monday thru Friday.
>=20
> -----Original Message-----
> From: Matthias Fischer <matthias.fischer(a)ipfire.org>=20
> Sent: Friday, December 11, 2020 6:34 PM
> To: Kienker, Fred; michael.tremer <michael.tremer(a)ipfire.org>;=20
> stefan.schantl <stefan.schantl(a)ipfire.org>
> Cc: development <development(a)lists.ipfire.org>
> Subject: Re: suricata 6.0.0 / 6.0.1 - cpu load (idle) rising compared to=20
> 5.0.4
>=20
> Hi,
>=20
> looks as if there is something going on in the suricata forum regarding=20
> cpu load:
>=20
> =3D> https://forum.suricata.io/t/cpu-usage-of-version-6-0-0/706
>=20
> I can't really interpret the numrous screenshots and ongoing=20
> discussions, but could it be that this is related to what I'm=20
> experiencing when upgrading from 5.0.x to 6.0.x?
>=20
> Best,
> Matthias
>=20
>=20


--===============6286063783608646226==--