[Oisf-users] Configuring cpu affinity for suricata 1.4.7

[C. L. Martinez]

Hi all,

 I am running two suricata instances in a host with 6 cores. I would
like to configure cpu affinity for both instances to use only 2,3,4,5
cores.

 For suricata01 I have tried the following config:

threading:
  set-cpu-affinity: no
  cpu-affinity:
    - management-cpu-set:
        cpu: [ 2 ]  # include only these cpus in affinity settings
    - receive-cpu-set:
        cpu: [ 2 ]  # include only these cpus in affinity settings
    - decode-cpu-set:
        cpu: [ 2,3 ]
        mode: "balanced"
    - stream-cpu-set:
        cpu: [ 2,3 ]
    - detect-cpu-set:
        cpu: [ 2 ]
        mode: "exclusive" # run detect threads in these cpus
        prio:
          #low: [ 0 ]
          medium: [ 3 ]
          high: [ 3 ]
          default: "medium"
    - verdict-cpu-set:
        cpu: [ 3 ]
        prio:
          default: "high"
    - reject-cpu-set:
        cpu: [ 3 ]
        prio:
          default: "low"
    - output-cpu-set:
        cpu: [ 3 ]
        prio:
           default: "medium"
  detect-thread-ratio: 1.5

 For suricata02 I have tried the following config:

threading:
  set-cpu-affinity: no
  cpu-affinity:
    - management-cpu-set:
        cpu: [ 4 ]  # include only these cpus in affinity settings
    - receive-cpu-set:
        cpu: [ 4 ]  # include only these cpus in affinity settings
    - decode-cpu-set:
        cpu: [ 4,5 ]
        mode: "balanced"
    - stream-cpu-set:
        cpu: [ 4,5 ]
    - detect-cpu-set:
        cpu: [ 4 ]
        mode: "exclusive" # run detect threads in these cpus
        prio:
          #low: [ 0 ]
          medium: [ 5 ]
          high: [ 5 ]
          default: "medium"
    - verdict-cpu-set:
        cpu: [ 5 ]
        prio:
          default: "high"
    - reject-cpu-set:
        cpu: [ 5 ]
        prio:
          default: "low"
    - output-cpu-set:
        cpu: [ 5 ]
        prio:
           default: "medium"
  detect-thread-ratio: 1.5

 But according to top output, sometimes both instances use the same
cores. What am I doing wrong??

Thanks.