<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>All,</p>
<p><br>
</p>
<p>I've done some tweaking to my test instance but can't seem to get it running properly. Here is what I did:</p>
<p><br>
</p>
<p>1) Took the dev-detect-grouping-v174 branch and merged master (as of this morning, 2016-02-29) into it.</p>
<p>2) Built Suricata and used my normal config file, but made the required changes in the "detect" section.</p>
<p><span> a. I tried the default (profile medium, toclient 3, toserver 25) but then also changed to 30 and 250 just to test. Same results with both.</span><br>
</p>
<p><span>3) I have 8 threads set, and I have management cpu set to 0,2 and detect cpu set to 4-14 (even number cores). </span></p>
<p><span>4) management cpu set is exclusive and high, so is detect cpu set</span></p>
<p><span><br>
</span></p>
<p><span>Suricata starts up very quickly (few seconds) and consumes very little RAM. However, I get cpu 0 with a very small use %, and cpu's 4 & 14 pegged at 100%. kernel_drops are extremely high (compared to my working config).</span></p>
<p><span><br>
</span></p>
<p><span>I know I've got a lot of variables in this setup, but does anyone see anything obviously wrong with how I've set things up? Should I stop separating out the management CPU set and just run them on the CPUs that the detect threads run on?</span></p>
<p><span><br>
</span></p>
<p><span>Thanks,</span></p>
<p><span>Joey Barkley</span></p>
</div>
</body>
</html>