<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 08/03/2011 08:50 AM, Gene Albin wrote:
<blockquote
cite="mid:CACUc1WP5zoUjV9JCg-9u-nUCLUfYmmaA_QShCeH-7PgfbnAtXA@mail.gmail.com"
type="cite">So I just installed Suricata on one of our research
computers with lots of cores available. I'm looking to see what
kind of performance boost I get as I bump up the CPU's. After my
first run I was surprised to see that I didn't get much of a boost
when going from 8 to 32 CPUs. I was running a 6GB pcap file with
a about 17k rules loaded. The first run on 8 cores took 190sec.
The second run on 32 cores took 170 sec. Looks like something
other than CPU is the bottle neck. <br>
<br>
My first guess is Disk IO. Any recommendations on how I could
check/verify that guess?<br>
<br>
Gene<br>
<br>
-- <br>
Gene Albin<br>
<a moz-do-not-send="true" href="mailto:gene.albin@gmail.com"
target="_blank">gene.albin@gmail.com</a><br>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Oisf-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>
</pre>
</blockquote>
<tt><br>
* forgot to reply to the list previously<br>
<br>
Hey Gene.<br>
<br>
Can you test by increasing the max-pending-packets in the
suricata.yaml file to a higher value. You can try one run with a
value of 500 and then try higher values(2000+ suggested. More the
better, as long as you don't hit swap).</tt><br>
<br>
<tt>Once you have set a higher max-pending-packets you can try
running suricata in autofp runmode. autofp mode runs suricata in
flow-pinned mode</tt>. <tt>To do this add this option to your
suricata command line "--runmode=autofp. "<br>
<br>
sudo suricata -c ./suricata.yaml -r your_pcap.pcap
--runmode=autofp<br>
<br>
With max-pending-packets set to a higher value and with
--runmode=autofp, you can test how suricata scales from 4 to 32
cores.<br>
<br>
<br>
</tt>
</body>
</html>