<div dir="ltr">Hello Giuseppe,<div><br></div><div>I've seen a better behaviour, but still see a little decrease in the info logged. I was having 800-1200 logs per second and then restarted suricata and got 1700-2500 logs per second for a few minutes and then back again to similar numbers than before the restart.</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Dec 17, 2014 at 6:25 PM, Jose Vila <span dir="ltr"><<a href="mailto:jovimon@gmail.com" target="_blank">jovimon@gmail.com</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hello Giuseppe, <div><br></div><div>Thank you very much for your help.<br><div><br></div><div>My PF_RING info:</div><div><div># cat /proc/net/pf_ring/info </div><div>PF_RING Version : 6.0.3 ($Revision: 8707$)</div><div>Total rings : 0</div><div><br></div><div>Standard (non DNA/ZC) Options</div><div>Ring slots : 4096</div><div>Slot version : 16</div><div>Capture TX : Yes [RX+TX]</div><div>IP Defragment : No</div><div>Socket Mode : Standard</div><div>Total plugins : 0</div><div>Cluster Fragment Queue : 0</div><div>Cluster Fragment Discard : 0</div></div><div><br></div><div>I just made the changes you commented, and had some issues:</div><div><br></div><div>With 64k slots in pf_ring suricata doesn't start, and suricata.log shows errors not finding pf_ring.</div><div><br></div><div>I've done some testing and found an acceptable value at 32767 for both pf_ring ring slots and default-packet-size (bigger values make my system unstable, I even had to restart twice).</div><div><br></div><div>I'm leaving it and see how it behaves tomorrow at peak time.<br></div><div><br></div><div>Just a couple questions:</div><div><br></div><div>* Both values (ring slots and packet size) must be the same? </div><div><br></div><div>* Which is the max packet size pf_ring is going to pass to Suricata?</div><div><br></div><div>* Why was I experiencing this issue? Were the 4k queues flooded and the contents overwritten before they were processed, causing packet and alert loss even without any drop being detected?</div><div><br></div><div>* Is there any document where you can "see" how this values impact in RAM usage?</div><div><br></div><div>Regards,</div><div><br></div><div>Jose Vila.</div><div><br></div></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Dec 17, 2014 at 2:33 PM, Giuseppe Longo <span dir="ltr"><<a href="mailto:giuseppelng@gmail.com" target="_blank">giuseppelng@gmail.com</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>Hi Jose,<br>
You may need to tune your configuration.<br>
<br>
Let's start from PF_RING:<br>
# cat /proc/net/pf_ring/info<br>
<br>
If the ring slot value is 4096, try to increase it:<br>
rmmod pf_ring<br>
modprobe pf_ring transparent_mode=0 min_num_slots=65534<br>
<br>
Then adjust the default-packet-size value in suricata.yaml:<br>
default-packet-size: 65535<br>
<br>
<br>
</span><span>Cheers,<br>
Giuseppe<br>
<br>
2014-12-17 12:47 GMT+01:00 Jose Vila <<a href="mailto:jovimon@gmail.com" target="_blank">jovimon@gmail.com</a>>:<br>
</span><div><div>> Hello,<br>
><br>
> I just updated to Suricata 2.0.3 and PF_RING 6.0.3 from SVN, and this<br>
> behaviour still persists.<br>
><br>
> Can someone help?<br>
><br>
> Thanks.<br>
><br>
> On Tue, Dec 16, 2014 at 10:28 AM, Jose Vila <<a href="mailto:jovimon@gmail.com" target="_blank">jovimon@gmail.com</a>> wrote:<br>
>><br>
>> Hello list,<br>
>><br>
>> I'm moving from snort to Suricata, and I'm getting some problems.<br>
>><br>
>> Before I had Snort 2.9.3.1 w/PF_RING 5.5.0, and had to pass parameter<br>
>> "--daq-var no-kernel-filters=1" to Snort because the packet receive rate was<br>
>> slowly decreasing to the point of only 1/10 of the traffic being processed<br>
>> by Snort.<br>
>><br>
>> Now with Suricata 2.0.3 and PF_RING 5.5.0 i'm seeing the same behaviour<br>
>> ...<br>
>><br>
>> If I count lines of log written to eve.json as Peter Manev does (see [1]),<br>
>> at suricata's start i get 2K-5K logs per second, but after a couple of days<br>
>> I only get 5-20 entries per second. Also, drop counters in stats.log turned<br>
>> from less than 0.1% to around 10%.<br>
>><br>
>> Is there a way to pass this variable (no-kernel-filters) to PF_RING<br>
>> through Suricata?<br>
>><br>
>> Thanks,<br>
>><br>
>> Jose Vila.<br>
>><br>
>> [1]<br>
>> <a href="http://pevma.blogspot.com.es/2014/05/logs-per-second-on-evejson-good-and-bad.html" target="_blank">http://pevma.blogspot.com.es/2014/05/logs-per-second-on-evejson-good-and-bad.html</a><br>
><br>
><br>
</div></div><div><div>> _______________________________________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> Training now available: <a href="http://suricata-ids.org/training/" target="_blank">http://suricata-ids.org/training/</a><br>
</div></div></blockquote></div></div>
</div></div></blockquote></div></div>