[Oisf-devel] Running suricata in valgrind (callgrind)

[Victor Julien]

Thanks Pierre, good suggestion. It's non-trivial at this point though,
so we may hold off this change for a while. But I agree a lot of
performance gain will likely be reached there. Definitely something on
my todo list.

Cheers,
Victor

Pierre Chifflier wrote:
> Hi,
> 
> I was wondering why starting Suricata takes so much time (especially in
> valgrind) so I decided to run suricata in callgrind.
> 
> This took some time but the results are very interesting !
> 
> Tests:
> Git from today (ead13bda4aa7a94e265cd632db809fb0a44837cf)
> 70 rule files processed. 3077 rules succesfully loaded, 38 rules failed
> 
> Most (98.21%) of the startup time is spent in SigLoadSignatures. Opening
> the trace (not attached to this mail, but I can send it if you want) in
> kcachegrind shows 37 millions of calls to DetectAddressCmpIPv4 !
> 
> Looking at the code, it seems that signatures are stored in an ordered
> linked list (in stage 3) ... This is clearly inefficient and can lead to
> exponential insert time
> Is there a reason for this ? If no, maybe this could be changed to a
> better structure, for ex. a btree, a red-black tree or whatever ?
> 
> Attached is an export of the call graph.
> 
> Cheers,
> Pierre
> 
> 
> 
> ------------------------------------------------------------------------
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Oisf-devel mailing list
> Oisf-devel at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel


-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------