<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Thanks Duarte and Coop!<div><br><div><div>On 14/08/2014, at 7:11 pm, Duarte Silva <<a href="mailto:duarte.silva@serializing.me">duarte.silva@serializing.me</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi,<br><br>in your configuration you should enable affinity :P<br><br><blockquote type="cite">#<br># On Intel Core2 and Nehalem CPU's enabling this will degrade performance.<br>#<br>set-cpu-affinity: no<br></blockquote><br>Change this to yes, otherwise any settings bellow will be ignored.<br></blockquote></div><br></div><div>I fixed that but the behaviour has not changed much it is still hogging one CPU. </div><div><br></div><div>Looking at the startup logs I see:</div><div><br></div><div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Core dump size set to unlimited. </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - dropped the caps for main thread </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - fast output device (regular) initialized: fast.log </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Unified2-alert initialized: filename unified2.alert, limit 32 MB </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Adding interface eth3 from config file </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Found affinity definition for "management-cpu-set" </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Found affinity definition for "receive-cpu-set" </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Found affinity definition for "decode-cpu-set" </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Found affinity definition for "stream-cpu-set" </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Found affinity definition for "detect-cpu-set" </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Using default prio 'medium' </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Found affinity definition for "verdict-cpu-set" </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Using default prio 'high' </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Found affinity definition for "reject-cpu-set" </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Using default prio 'low' </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Found affinity definition for "output-cpu-set" </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Using default prio 'medium' </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Using flow cluster mode for PF_RING (iface eth3) </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Going to use 1 thread(s) </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Setting affinity on CPU 13 </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Setting prio -2 for "RxPFReth31" Module to cpu/core 13, thread id 9432 </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Error> - [ERRCODE: SC_ERR_THREAD_NICE_PRIO(47)] - Error setting nice value for thread RxPFReth31: Operation not permitted </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - (RxPFReth31) Using PF_RING v.5.6.1, interface eth3, cluster-id 99, single-pfring-thread </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:08 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - RunModeIdsPfringWorkers initialised </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:09 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - Setting prio 0 for "FlowManagerThread" thread , thread id 9433 </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:09 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - stream "max-sessions": 262144 </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:09 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - stream "prealloc-sessions": 32768 </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:09 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - stream "memcap": 33554432 </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:09 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - stream "midstream" session pickups: disabled </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:09 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - stream "async-oneside": disabled </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:09 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - stream "checksum-validation": enabled </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:09 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - stream."inline": disabled </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:09 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - stream.reassembly "memcap": 67108864 </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:09 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - stream.reassembly "depth": 1048576 </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:09 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - stream.reassembly "toserver-chunk-size": 2560 </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:09 secmonprd02 suricata: 14/8/2014 -- 22:15:08 - <Info> - stream.reassembly "toclient-chunk-size": 2560 </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:09 secmonprd02 suricata: 14/8/2014 -- 22:15:09 - <Info> - Setting prio 0 for "SCPerfWakeupThread" thread , thread id 9434 </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:09 secmonprd02 suricata: 14/8/2014 -- 22:15:09 - <Info> - Setting prio 0 for "SCPerfMgmtThread" thread , thread id 9435 </div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">Aug 14 22:15:09 secmonprd02 suricata: 14/8/2014 -- 22:15:09 - <Info> - all 1 packet processing threads, 3 management threads initialized, engine started. </div></div><div><br></div><div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">I get affinity set for just cpu 13.</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">I am guessing the nice fails because I have dropped prigs.</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo;">here is the current config:</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"><div style="margin: 0px;"># Tune cpu affinity of suricata threads. Each family of threads can be bound</div><div style="margin: 0px;"> # on specific CPUs.</div><div style="margin: 0px;"> cpu-affinity:</div><div style="margin: 0px;"> - management-cpu-set:</div><div style="margin: 0px;"> cpu: [ 10 ] # include only these cpus in affinity settings</div><div style="margin: 0px;"> - receive-cpu-set:</div><div style="margin: 0px;"> cpu: [ 10 ] # include only these cpus in affinity settings</div><div style="margin: 0px;"> - decode-cpu-set:</div><div style="margin: 0px;"> cpu: [ 10, 11 ]</div><div style="margin: 0px;"> mode: "balanced"</div><div style="margin: 0px;"> - stream-cpu-set:</div><div style="margin: 0px;"> cpu: [ "10-11" ]</div><div style="margin: 0px;"> - detect-cpu-set:</div><div style="margin: 0px;"> cpu: [ "13-15" ]</div><div style="margin: 0px;"> mode: "exclusive" # run detect threads in these cpus</div><div style="margin: 0px;"> # Use explicitely 3 threads and don't compute number by using</div><div style="margin: 0px;"> # detect-thread-ratio variable:</div><div style="margin: 0px;"> threads: 3</div><div style="margin: 0px;"> prio:</div><div style="margin: 0px;"> low: [ 10 ]</div><div style="margin: 0px;"> medium: [ "11-12" ]</div><div style="margin: 0px;"> high: [ 13 ]</div><div style="margin: 0px;"> default: "medium"</div><div style="margin: 0px;"> - verdict-cpu-set:</div><div style="margin: 0px;"> cpu: [ 10 ]</div><div style="margin: 0px;"> prio:</div><div style="margin: 0px;"> default: "high"</div><div style="margin: 0px;"> - reject-cpu-set:</div><div style="margin: 0px;"> cpu: [ 10 ]</div><div style="margin: 0px;"> prio:</div><div style="margin: 0px;"> default: "low"</div><div style="margin: 0px;"> - output-cpu-set:</div><div style="margin: 0px;"> cpu: [ "all" ]</div><div style="margin: 0px;"> prio:</div><div style="margin: 0px;"> default: "medium"</div><p style="margin: 0px; min-height: 13px;"> <br class="webkit-block-placeholder"></p><p style="margin: 0px; min-height: 13px;"><br></p><p style="margin: 0px; min-height: 13px;">I also uncommented the “threads: 3” under -detect-cpu-set</p><div><br></div><div>It is cpu13 that is running at 100% </div></div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></div></div></body></html>