[Oisf-users] Suricata with IRQBalance

[Yasha Zislin]

Does anybody use IRQBalance to ballance interrupts for nic processing?

I have set up IRQBalance service (in CentOS).

After viewing stats in /proc/interrupts, I feel like it is not working.

            CPU0     CPU1   CPU2    CPU3

56:          0          0          0  337763094   PCI-MSI-edge      eth0
 57:          0          0          0          0            PCI-MSI-edge      eth0:1
 58:          0          0          0          0            PCI-MSI-edge      eth0:2
 59:          0          0          0          0            PCI-MSI-edge      eth0:3

It looks like only one CPU is doing the work here. Am I correct?

In the past I have tried configuring affinity in Suricata config and had hard time since Packet Loss would even get worse.

Are there any guides on how to configure CPU interrupts for Suricata? I feel like I am loosing performance here.


Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20160523/c2c88422/attachment.html>