<div dir="ltr">strace only shows the process doing constant:<div><div>nanosleep({0, 10000000}, NULL) = 0</div><div>nanosleep({0, 10000000}, NULL) = 0</div><div>nanosleep({0, 10000000}, NULL) = 0</div><div>nanosleep({0, 10000000}, NULL) = 0</div><div>nanosleep({0, 10000000}, NULL) = 0</div><div>nanosleep({0, 10000000}, NULL) = 0</div></div><div>....</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jul 30, 2015 at 2:17 PM, Duane Howard <span dir="ltr"><<a href="mailto:duane.security@gmail.com" target="_blank">duane.security@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I can reproduce. I ran it on a single low volume real NIC with the same result. Nothing terribly interesting in suricata.log with -vv enabled:<div>Here's the logs after rule and config loading:</div><div><br></div><div><div>30/7/2015 -- 21:14:06 - <Info> - Core dump size set to unlimited.</div><div>30/7/2015 -- 21:14:06 - <Info> - Unified2-alert initialized: filename suricata.u2, limit 128 MB</div><div>30/7/2015 -- 21:14:06 - <Info> - Syslog output initialized</div><div>30/7/2015 -- 21:14:06 - <Info> - Unable to find af-packet config for interface "eth0" or "default", using default value</div><div>30/7/2015 -- 21:14:06 - <Info> - Going to use 1 thread(s)</div><div>30/7/2015 -- 21:14:06 - <Info> - Enabling zero copy mode</div><div>30/7/2015 -- 21:14:06 - <Info> - RunModeIdsAFPWorkers initialised</div><div>30/7/2015 -- 21:14:06 - <Notice> - all 1 packet processing threads, 3 management threads initialized, engine started.</div><div>30/7/2015 -- 21:14:06 - <Info> - Using interface 'eth0' via socket 7</div><div>30/7/2015 -- 21:14:06 - <Info> - All AFP capture threads are running.</div><div>30/7/2015 -- 21:14:06 - <Info> - Thread AFPacketeth01 using socket 7</div><div>30/7/2015 -- 21:14:06 - <Info> - Starting to read on AFPacketeth01</div><div>^C30/7/2015 -- 21:15:27 - <Notice> - Signal Received. Stopping engine.</div><div>30/7/2015 -- 21:15:27 - <Info> - 0 new flows, 0 established flows were timed out, 0 flows in closed state</div><div>30/7/2015 -- 21:15:28 - <Info> - time elapsed 81.925s</div><div>30/7/2015 -- 21:15:28 - <Info> - (AFPacketeth01) Kernel: Packets 3372, dropped 0</div><div>30/7/2015 -- 21:15:28 - <Info> - (AFPacketeth01) Packets 3345, bytes 1318862</div><div>30/7/2015 -- 21:15:28 - <Info> - Stream TCP processed 2723 TCP packets</div><div>30/7/2015 -- 21:15:28 - <Info> - (AFPacketeth01) Alerts 0</div><div>30/7/2015 -- 21:15:28 - <Info> - Alert unified2 module wrote 0 alerts</div><div>30/7/2015 -- 21:15:28 - <Info> - host memory usage: 390144 bytes, maximum: 16777216</div><div>30/7/2015 -- 21:15:28 - <Info> - cleaning up signature grouping structure... complete</div><div>30/7/2015 -- 21:15:28 - <Notice> - Stats for 'eth0': pkts: 3372, drop: 0 (0.00%), invalid chksum: 0</div></div><div><br></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jul 30, 2015 at 2:02 PM, Peter Manev <span dir="ltr"><<a href="mailto:petermanev@gmail.com" target="_blank">petermanev@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div><br></div><div>On 30 jul 2015, at 21:50, Duane Howard <<a href="mailto:duane.security@gmail.com" target="_blank">duane.security@gmail.com</a>> wrote:<br><br><br></div><div>Can you reproduce this problem at will? Anything in verbose mode in Suricata.log? </div><div><br></div><div>Can you narrow it down to a relation of a single interface configuration (as you mention in your initial mail)?</div><div><br></div><div>Thanks</div><div><div><div><br></div><div><br></div><blockquote type="cite"><div><div dir="ltr"><div>This is Suricata version 2.0.8 RELEASE</div><div>Features: PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 PF_RING AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK </div><div>SIMD support: none</div><div>Atomic intrisics: 1 2 4 8 byte(s)</div><div>64-bits, Little-endian architecture</div><div>GCC version 4.6.3, C version 199901</div><div>compiled with -fstack-protector</div><div>compiled with _FORTIFY_SOURCE=2</div><div>L1 cache line size (CLS)=64</div><div>compiled with LibHTP v0.5.17, linked against LibHTP v0.5.17</div><div>Suricata Configuration:</div><div> AF_PACKET support: yes</div><div> PF_RING support: yes</div><div> NFQueue support: no</div><div> NFLOG support: no</div><div> IPFW support: no</div><div> DAG enabled: no</div><div> Napatech enabled: no</div><div> Unix socket enabled: no</div><div> Detection enabled: yes</div><div><br></div><div> libnss support: no</div><div> libnspr support: no</div><div> libjansson support: no</div><div> Prelude support: no</div><div> PCRE jit: no</div><div> LUA support: no</div><div> libluajit: no</div><div> libgeoip: yes</div><div> Non-bundled htp: yes</div><div> Old barnyard2 support: no</div><div> CUDA enabled: no</div><div><br></div><div> Suricatasc install: yes</div><div><br></div><div> Unit tests enabled: no</div><div> Debug output enabled: no</div><div> Debug validation enabled: no</div><div> Profiling enabled: no</div><div> Profiling locks enabled: no</div><div> Coccinelle / spatch: no</div><div><br></div><div>Generic build parameters:</div><div> Installation prefix (--prefix): /usr</div><div> Configuration directory (--sysconfdir): /etc/suricata/</div><div> Log directory (--localstatedir) : /var/log/suricata/</div><div><br></div><div> Host: x86_64-pc-linux-gnu</div><div> GCC binary: gcc</div><div> GCC Protect enabled: no</div><div> GCC march native enabled: no</div><div> GCC Profile enabled: no</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jul 30, 2015 at 1:41 PM, Peter Manev <span dir="ltr"><<a href="mailto:petermanev@gmail.com" target="_blank">petermanev@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><span><div><br></div><div><br>On 30 jul 2015, at 20:58, Duane Howard <<a href="mailto:duane.security@gmail.com" target="_blank">duane.security@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr">When closing suri it reports 0 packets for the interface I'm mainly concerned with. There's also nothing in fast or other logs to indicate traffic.<div><br></div><div>30/7/2015 -- 19:58:41 - <Notice> - Stats for 'bond0': pkts: 0, drop: 0 (-nan%), invalid chksum: 0<br></div></div><div class="gmail_extra"><br></div></div></blockquote><div><br></div></span><div>What is the output of suricata --build-info ?</div><div><br></div><div>If you have perf tools installed have a look at what in Suricata uses the most CPU - </div><div>perf top -p pidofsuri</div><div><br></div><div>Thanks </div><div><div><div><br></div><br><blockquote type="cite"><div><div class="gmail_extra"><div class="gmail_quote">On Thu, Jul 30, 2015 at 12:57 PM, Alan Wanderley dos Santos <span dir="ltr"><<a href="mailto:alan.santos@rnp.br" target="_blank">alan.santos@rnp.br</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="font-family:Andale Mono;font-size:12pt;color:#000000"><div>Didi you see the fast.log and others logs? </div><div><br></div><div>Maybe there are some traffic (icmp or broadcast for example) coming to virtual machine, even little being data, can generated a lot of logs and degree the performance.</div><div><br></div><div>I had a similar situation on a VM of testing.</div><div><br></div><div>Just a shot into darkness rsrs</div><div><br></div><div>Regards,</div><div><br></div><div>-----------------------------------------------<br>Alan Santos<br>Analista de Segurança<br>Centro de Atendimento a Incidentes de Segurança (CAIS)<br>Rede Nacional de Ensino e Pesquisa (RNP)<br>(19) 3787-3314 | <a href="mailto:alan.santos@rnp.br" target="_blank">alan.santos@rnp.br</a></div><br><hr><div><b>De: </b>"Duane Howard" <<a href="mailto:duane.security@gmail.com" target="_blank">duane.security@gmail.com</a>><br><b>Para: </b>"oisf-users" <<a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a>><br><b>Enviadas: </b>Quinta-feira, 30 de julho de 2015 16:50:51<br><b>Assunto: </b>[Oisf-users] Suricata using 35% cpu with no load?<br></div><br><div><span><div dir="ltr">I've got a random virtual testing machine, and I'm seeing Suricata sitting at about 35% CPU load, even though there's absolutely no traffic heading to it at the moment. Is there an easy way to get Suricata to tell me what it's doing that would cause this? It occurs on real interfaces with low traffic, loopback, as well as bonds where there's no trafic.<br><div>./d</div></div>
<br></span>_______________________________________________<br>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net" target="_blank">http://oisfevents.net</a><br></div></div></div></blockquote></div><br></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a></span><br><span>Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a></span><br><span>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a></span><br><span>Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net" target="_blank">http://oisfevents.net</a></span></div></blockquote></div></div></div></blockquote></div><br></div>
</div></blockquote></div></div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>