public inbox for development@lists.ipfire.org
 help / color / mirror / Atom feed
From: "Kienker, Fred" <fkienker@at4b.com>
To: development@lists.ipfire.org
Subject: RE: suricata 6.0.0 / 6.0.1 - cpu load (idle) rising compared to 5.0.4
Date: Fri, 11 Dec 2020 20:18:04 -0500	[thread overview]
Message-ID: <H000007e004e3c70.1607735884.mail.at4b.com@MHS> (raw)
In-Reply-To: <770a7f98-f35a-4a56-7fde-79e0bc86dc3d@ipfire.org>

[-- Attachment #1: Type: text/plain, Size: 1664 bytes --]

Matthas:

I worked through some of the examples of the settings described in the 
Suricata forum discussion. If my observations is correct, the issue 
centers around the flow manager. A change to it has made a big 
difference it the resource usage by this process. Its likely going to 
come down to live with the load created the v6 version or revert to v5 
and wait for them to get to the bottom of this. No combination of 
settings in the flow section of suricata.yaml ever seemed to reduce it 
and instead increased it.

I don't use low power systems for IPFire and dont have access to one 
but others with these systems may want to take a look at their 
performance numbers and report back as to whether they can live with the 
higher load.

Best regards, 
Fred

Please note: Although we may sometimes respond to email, text and phone 
calls instantly at all hours of the day, our regular business hours are 
9:00 AM - 6:00 PM ET, Monday thru Friday.

-----Original Message-----
From: Matthias Fischer <matthias.fischer(a)ipfire.org> 
Sent: Friday, December 11, 2020 6:34 PM
To: Kienker, Fred; michael.tremer <michael.tremer(a)ipfire.org>; 
stefan.schantl <stefan.schantl(a)ipfire.org>
Cc: development <development(a)lists.ipfire.org>
Subject: Re: suricata 6.0.0 / 6.0.1 - cpu load (idle) rising compared to 
5.0.4

Hi,

looks as if there is something going on in the suricata forum regarding 
cpu load:

=> https://forum.suricata.io/t/cpu-usage-of-version-6-0-0/706

I can't really interpret the numrous screenshots and ongoing 
discussions, but could it be that this is related to what I'm 
experiencing when upgrading from 5.0.x to 6.0.x?

Best,
Matthias



  reply	other threads:[~2020-12-12  1:18 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <H000007e004e35e1.1607700049.mail.at4b.com@MHS>
2020-12-11 16:00 ` Matthias Fischer
2020-12-11 19:07   ` Matthias Fischer
2020-12-11 23:33     ` Matthias Fischer
2020-12-12  1:18       ` Kienker, Fred [this message]
2020-12-14 14:26         ` Michael Tremer
2020-12-14 15:58           ` Peter Müller
2020-12-14 18:22             ` Adolf Belka
2020-12-14 20:34             ` Peter Müller
2020-12-14 16:07           ` Kienker, Fred
2020-12-12  0:52   ` Kienker, Fred
     [not found] <276ec94c-01ff-9bce-16ce-234a2336c4c7@ipfire.org>
2020-12-10 19:36 ` Michael Tremer
2020-12-11 16:03   ` Matthias Fischer
2020-12-06 10:08 Matthias Fischer
2020-12-10 13:39 ` Michael Tremer
2020-12-10 17:46   ` Matthias Fischer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=H000007e004e3c70.1607735884.mail.at4b.com@MHS \
    --to=fkienker@at4b.com \
    --cc=development@lists.ipfire.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox