<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I have 4 threads running to monitor one interface. One of the threads is consuming 100% CPU and starts to have packet loss. Other 3 have zero packet loss.<br><br><div>> Date: Wed, 23 Dec 2015 22:36:44 +0100<br>> Subject: Re: [Oisf-users] unusual packet loss<br>> From: petermanev@gmail.com<br>> To: coolyasha@hotmail.com<br>> CC: oisf-users@lists.openinfosecfoundation.org<br>> <br>> On Wed, Dec 23, 2015 at 3:36 PM, Yasha Zislin <coolyasha@hotmail.com> wrote:<br>> > I am running Suricata 2.1beta4 with PF_RING.<br>> > I have 4 threads (4 logical CPUs) monitoring one interface. After a few<br>> > minutes of running, I get 50% packet loss.<br>> > I have tweaked all of the stream reassembly buffers to avoid packet loss.<br>> > Only one of the threads gets kernel packet drops. I've noticed that one CPU<br>> > is running at 100% and others are almost idle. Looking at stats.log, that<br>> > one thread for some reason is digesting more packets than others.<br>> > Throughput on this sensor is not that big. About 500k packets a minute. I<br>> > use this image on other sensors without issues.<br>> ><br>> > Need help to figure out why only one thread is doing MOST of the work.<br>> <br>> Can you share "top -H" screenshot ?<br>> <br>> ><br>> > Thank you.<br>> ><br>> > _______________________________________________<br>> > Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> > Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>> > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> > Suricata User Conference November 4 & 5 in Barcelona: http://oisfevents.net<br>> <br>> <br>> <br>> -- <br>> Regards,<br>> Peter Manev<br></div> </div></body>
</html>