[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 35cdc506b06ed2e5fc8f7ad7fe57239eaadbda58

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 35cdc506b06ed2e5fc8f7ad7fe57239eaadbda58

[Michael Tremer]

[-- Attachment #1: Type: text/plain, Size: 3480 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  35cdc506b06ed2e5fc8f7ad7fe57239eaadbda58 (commit)
       via  4d093b810552339a6a7df774412c8e144f799331 (commit)
      from  effa44650ebc227d99a3781ba962e015a3430d3a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 35cdc506b06ed2e5fc8f7ad7fe57239eaadbda58
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Tue Mar 26 21:58:01 2019 +0000

    suricata: Enable CPU affinity
    
    This will tie the detection threads to a certain CPU and
    slightly increases throughput on my system.
    
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

commit 4d093b810552339a6a7df774412c8e144f799331
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Tue Mar 26 21:18:45 2019 +0000

    suricata: Tie queues to a CPU core
    
    This should improve performance by a small margin
    
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/suricata/suricata.yaml   | 13 +++++--------
 src/initscripts/system/suricata |  4 ++--
 2 files changed, 7 insertions(+), 10 deletions(-)

Difference in files:
diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml
index 3b50157bf..8580827a1 100644
--- a/config/suricata/suricata.yaml
+++ b/config/suricata/suricata.yaml
@@ -697,7 +697,7 @@ spm-algo: auto
 
 # Suricata is multi-threaded. Here the threading can be influenced.
 threading:
-  set-cpu-affinity: no
+  set-cpu-affinity: yes
   # Tune cpu affinity of threads. Each family of threads can be bound
   # on specific CPUs.
   #
@@ -717,18 +717,15 @@ threading:
     - worker-cpu-set:
         cpu: [ "all" ]
         mode: "exclusive"
-        # Use explicitely 3 threads and don't compute number by using
-        # detect-thread-ratio variable:
-        # threads: 3
         prio:
           low: [ 0 ]
           medium: [ "1-2" ]
           high: [ 3 ]
           default: "medium"
-    #- verdict-cpu-set:
-    #    cpu: [ 0 ]
-    #    prio:
-    #      default: "high"
+    - verdict-cpu-set:
+        cpu: [ 0 ]
+        prio:
+          default: "high"
   #
   # By default Suricata creates one "detect" thread per available CPU/CPU core.
   # This setting allows controlling this behaviour. A ratio setting of 2 will
diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index ae434df65..16548753e 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -75,8 +75,8 @@ function generate_fw_rules {
 			# Check if there are multiple cpu cores available.
 			if [ "$cpu_count" -gt "1" ]; then
 				# Balance beetween all queues.
-				NFQ_OPTIONS+="--queue-balance 0:"
-				NFQ_OPTIONS+=$(($cpu_count-1))
+				NFQ_OPTIONS+="--queue-balance 0:$(($cpu_count-1))"
+				NFQ_OPTIONS+=" --queue-cpu-fanout"
 			else
 				# Send all packets to queue 0.
 				NFQ_OPTIONS+="--queue-num 0"


hooks/post-receive
--
IPFire 2.x development tree