[Oisf-users] Suricata with IRQBalance

[Andreas Herz]

On 23/05/16 at 19:27, Yasha Zislin wrote:
> Does anybody use IRQBalance to ballance interrupts for nic processing?

Peter Manev knows more about IRQs :)

> I have set up IRQBalance service (in CentOS).
> 
> After viewing stats in /proc/interrupts, I feel like it is not working.
> 
>             CPU0     CPU1   CPU2    CPU3
> 
> 56:          0          0          0  337763094   PCI-MSI-edge      eth0
>  57:          0          0          0          0            PCI-MSI-edge      eth0:1
>  58:          0          0          0          0            PCI-MSI-edge      eth0:2
>  59:          0          0          0          0            PCI-MSI-edge      eth0:3
> 
> It looks like only one CPU is doing the work here. Am I correct?

How did you do the setup?

> In the past I have tried configuring affinity in Suricata config and had hard time since Packet Loss would even get worse.
> 
> Are there any guides on how to configure CPU interrupts for Suricata? I feel like I am loosing performance here.

Do you have any more details about that behaviour?
Which version are you running in what capture/runmode?

> 
> Thank you.

> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net


-- 
Andreas Herz