<p dir="ltr">From my experience, I had to change the irqbalance (/etc/sysconfig/irqbalance file on RHEL) parameters to ignore the IRQ's related with the Ethernet card queues (option --banirq if I'm not mistaken). Otherwise, it would overwrite the affinity settings I defined.</p>

<p dir="ltr">On 21 Aug 2013 21:10, "Cooper F. Nelson" <<a href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a>> wrote:<br>
><br>
> -----BEGIN PGP SIGNED MESSAGE-----<br>
> Hash: SHA1<br>
><br>
> I looked at your attached /proc/interrupts file; something is definitely<br>
> off as it looks like the the first RX queue for each interface is still<br>
> bound to core-0:<br>
><br>
> > grep TxRx-1$ Suricata-proc-interrupts.txt<br>
> >  127:,    64, 76049,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0    1674293,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0   PCI-MSI-edge, eth6-TxRx-1<br>
> >  161:,    59    1766722,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0   PCI-MSI-edge, eth4-TxRx-1<br>
> >  178:,    38, 73976,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0    1682548,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0,,0   PCI-MSI-edge, eth5-TxRx-1<br>
><br>
> Have you tried restarting irqbalance via "/etc/init.d/irqbalance<br>
> restart" after loading the driver?<br>
><br>
> On 8/21/2013 11:51 AM, Tritium Cat wrote:<br>
> ><br>
> > In theory irqbalance should work fine and set_irq_balance is only needed if<br>
> > one wanted to bind all packet processing of a flow from a queue to a<br>
> > dedicated core, as mentioned somewhere in the available Suricata 10G<br>
> > strategies; that's another area I'm not sure I setup correctly but I do not<br>
> > believe it is the cause of the performance issues.<br>
> ><br>
><br>
><br>
> - --<br>
> Cooper Nelson<br>
> Network Security Analyst<br>
> UCSD ACT Security Team<br>
> <a href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a> x41042<br>
> -----BEGIN PGP SIGNATURE-----<br>
> Version: GnuPG v2.0.17 (MingW32)<br>
> Comment: Using GnuPG with Thunderbird - <a href="http://www.enigmail.net/">http://www.enigmail.net/</a><br>
><br>
> iQEcBAEBAgAGBQJSFR7MAAoJEKIFRYQsa8FWymsH/iAbj6b7Xh3zIj7U5wNFAiqi<br>
> 8IwvArm0g5gx3FPzoyH/srVfkqIQIHOHH3WrCx3NpyGRfw51YDJ+lVHhLjuR7aTP<br>
> JeNXw35gq2/k0BpkWDS7q7cUN9x0vue5RjBQVtk16MUVlBJRP89QT5VWYSkJn2pb<br>
> Ib4Lgj2iGadMByMeDB7eB0MAVddzgRWWdLKTfckpCrdjkOhyCYJTAfyRZVxHHxwA<br>
> yqDkpQQnyp4BV9NSrjU8aedXmCuSRl/vpev1uwF0+ULBCIVmGhwfd4/QeR6ebRA0<br>
> /Ip1CtZKSNcMX2p4m56VZaJqcCyc6yILNI5WYL19XAlZtFR4/ApRgw64S8uJbTo=<br>
> =BFVi<br>
> -----END PGP SIGNATURE-----<br>
> _______________________________________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> OISF: <a href="http://www.openinfosecfoundation.org/">http://www.openinfosecfoundation.org/</a><br>
</p>