<div dir="ltr"><div><div>Russell,<br><br></div><div>Are you using af_packet or PF_RING?<br></div><div><br></div>Regards,<br><br></div>Will<br>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Aug 21, 2013 at 7:58 PM, Russell Fulton <span dir="ltr"><<a href="mailto:r.fulton@auckland.ac.nz" target="_blank">r.fulton@auckland.ac.nz</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi<br>
<br>
I just want to sanity check my config:<br>
<br>
  set-cpu-affinity: yes<br>
  # Tune cpu affinity of suricata threads. Each family of threads can be bound<br>
  # on specific CPUs.<br>
  cpu-affinity:<br>
    - management-cpu-set:<br>
        cpu: [ 10 ]  # include only these cpus in affinity settings<br>
    - receive-cpu-set:<br>
        cpu: [ 10 ]  # include only these cpus in affinity settings<br>
    - decode-cpu-set:<br>
        cpu: [ 10, 11 ]<br>
        mode: "balanced"<br>
    - stream-cpu-set:<br>
        cpu: [ "10-11" ]<br>
    - detect-cpu-set:<br>
        cpu: [ "13-15" ]<br>
        mode: "exclusive" # run detect threads in these cpus<br>
        # Use explicitely 3 threads and don't compute number by using<br>
        # detect-thread-ratio variable:<br>
        # threads: 3<br>
        prio:<br>
          low: [ 10 ]<br>
          medium: [ "11-12" ]<br>
          high: [ 13 ]<br>
          default: "medium"<br>
    - verdict-cpu-set:<br>
        cpu: [ 10 ]<br>
        prio:<br>
          default: "high"<br>
    - reject-cpu-set:<br>
        cpu: [ 10 ]<br>
        prio:<br>
          default: "low"<br>
    - output-cpu-set:<br>
        cpu: [ "all" ]<br>
        prio:<br>
           default: "medium"<br>
<br>
top shows<br>
<br>
Cpu10 :  8.5%us,  3.2%sy,  0.0%ni, 86.5%id,  0.0%wa,  0.0%hi,  1.8%si,  0.0%st<br>
Cpu11 :  5.1%us,  5.1%sy,  0.0%ni, 87.6%id,  0.0%wa,  0.0%hi,  2.2%si,  0.0%st<br>
Cpu12 :  3.9%us,  8.2%sy,  2.5%ni, 82.5%id,  0.0%wa,  0.0%hi,  2.9%si,  0.0%st<br>
Cpu13 : 90.7%us,  0.0%sy,  0.0%ni,  0.0%id,  0.0%wa,  0.0%hi,  9.3%si,  0.0%st<br>
Cpu14 :  9.4%us,  5.8%sy,  0.0%ni, 81.7%id,  0.0%wa,  0.4%hi,  2.9%si,  0.0%st<br>
Cpu15 :  4.1%us,  5.2%sy,  0.7%ni, 87.4%id,  0.0%wa,  0.0%hi,  2.6%si,  0.0%st<br>
<br>
is this as expected?  I had expected it to balance over 13-15 ?<br>
<br>
I took this from the SO default and added 10 to the CPU numbers.<br>
<br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br>
</blockquote></div><br></div>