<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><div><br>On 30 jul 2015, at 20:58, Duane Howard <<a href="mailto:duane.security@gmail.com">duane.security@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr">When closing suri it reports 0 packets for the interface I'm mainly concerned with. There's also nothing in fast or other logs to indicate traffic.<div><br></div><div>30/7/2015 -- 19:58:41 - <Notice> - Stats for 'bond0': pkts: 0, drop: 0 (-nan%), invalid chksum: 0<br></div></div><div class="gmail_extra"><br></div></div></blockquote><div><br></div><div>What is the output of suricata --build-info ?</div><div><br></div><div>If you have perf tools installed have a look at what in Suricata uses the most CPU - </div><div>perf top -p pidofsuri</div><div><br></div><div>Thanks </div><div><br></div><br><blockquote type="cite"><div><div class="gmail_extra"><div class="gmail_quote">On Thu, Jul 30, 2015 at 12:57 PM, Alan Wanderley dos Santos <span dir="ltr"><<a href="mailto:alan.santos@rnp.br" target="_blank">alan.santos@rnp.br</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="font-family:Andale Mono;font-size:12pt;color:#000000"><div>Didi you see the fast.log and others logs? </div><div><br></div><div>Maybe there are some traffic (icmp or broadcast for example) coming to virtual machine, even little being data, can generated a lot of logs and degree the performance.</div><div><br></div><div>I had a similar situation on a VM of testing.</div><div><br></div><div>Just a shot into darkness rsrs</div><div><br></div><div>Regards,</div><div><br></div><div>-----------------------------------------------<br>Alan Santos<br>Analista de Segurança<br>Centro de Atendimento a Incidentes de Segurança (CAIS)<br>Rede Nacional de Ensino e Pesquisa (RNP)<br>(19) 3787-3314 | <a href="mailto:alan.santos@rnp.br" target="_blank">alan.santos@rnp.br</a></div><br><hr><div><b>De: </b>"Duane Howard" <<a href="mailto:duane.security@gmail.com" target="_blank">duane.security@gmail.com</a>><br><b>Para: </b>"oisf-users" <<a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a>><br><b>Enviadas: </b>Quinta-feira, 30 de julho de 2015 16:50:51<br><b>Assunto: </b>[Oisf-users] Suricata using 35% cpu with no load?<br></div><br><div><span class=""><div dir="ltr">I've got a random virtual testing machine, and I'm seeing Suricata sitting at about 35% CPU load, even though there's absolutely no traffic heading to it at the moment. Is there an easy way to get Suricata to tell me what it's doing that would cause this? It occurs on real interfaces with low traffic, loopback, as well as bonds where there's no trafic.<br><div>./d</div></div>
<br></span>_______________________________________________<br>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net" target="_blank">http://oisfevents.net</a><br></div></div></div></blockquote></div><br></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a></span><br><span>Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a></span><br><span>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a></span><br><span>Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net">http://oisfevents.net</a></span></div></blockquote></body></html>