[Oisf-users] Suricata on 8 cores, ~70K packets/sec

[Victor Julien]

On 02/17/2011 09:16 AM, Chris Wakelin wrote:
> I've tried increasing the stream reassembly memcap to 512mb, and it
> still seems to use it all. I've not had any flow emergency mode recently
> though.

If you have the memory, try increasing it more :)

>>> [8492] 15/2/2011 -- 20:12:16 - (stream-tcp.c:466) <Info> (StreamTcpFreeConfig) -- Max memuse of stream engine 41353200 (in use 0)
>>
>> ... but that one didn't.
> 
> perhaps that's why it was leaking flows (or maybe just the decreased
> flow timeout helped)?

They use separate memcap settings, so I think only the timeouts should
influence the flow behavior here.

>>
>> Again, the decode1 thread ended up using all its CPU and the packet
>> count dropped to 5-6K per second. Strangely, I've not seen that before
>> today.
> 
> I've rebooted this server since (needed to turn on I/OAT in the BIOS)
> and it seems to have behaved since in this respect.

Thats odd. Please let me know if you see it happening again.

Cheers,
Victor

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------