[Oisf-devel] 77b708=WIN?

Tue Sep 27 15:29:13 UTC 2011

I like it because it's simple and I've tied each one of my 6 threads to
a particular CPU (set_cpu_affinity: yes).

Will comments in Issue 315
(https://redmine.openinfosecfoundation.org/issues/315) that performance
will be worse than autofp with one or two top talkers (which we have at
times - generally SSH between some of our researchers and supercomputing
clusters - a prime candidate perhaps for BPF filtering :) ). However,
load does seem pretty well balanced most of the time, e.g.:

> Cpu0  :  2.6%us,  3.0%sy,  0.0%ni, 92.8%id,  0.0%wa,  0.0%hi,  1.6%si,  0.0%st
> Cpu1  : 13.8%us,  1.9%sy,  0.0%ni, 82.6%id,  0.0%wa,  0.0%hi,  1.6%si,  0.0%st
> Cpu2  :  7.6%us,  2.3%sy,  0.0%ni, 89.1%id,  0.0%wa,  0.0%hi,  1.0%si,  0.0%st
> Cpu3  : 16.1%us,  0.3%sy,  0.0%ni, 82.6%id,  0.0%wa,  0.0%hi,  1.0%si,  0.0%st
> Cpu4  : 10.4%us,  2.3%sy,  0.0%ni, 85.6%id,  0.0%wa,  0.0%hi,  1.7%si,  0.0%st
> Cpu5  :  9.2%us,  1.0%sy,  0.0%ni, 88.7%id,  0.0%wa,  0.0%hi,  1.0%si,  0.0%st
> Cpu6  : 11.1%us,  0.7%sy,  0.0%ni, 87.3%id,  0.0%wa,  0.0%hi,  1.0%si,  0.0%st
> Cpu7  :  2.5%us,  1.9%sy,  0.0%ni, 94.9%id,  0.0%wa,  0.0%hi,  0.6%si,  0.0%st
> Mem:  16465276k total, 15615844k used,   849432k free,    23568k buffers
> Swap:  3906552k total,    57612k used,  3848940k free,  8889352k cached
> 
>   PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  P COMMAND                                                                                      
> 19502 snort     20   0  360m 280m 3028 R 20.2  1.7  30:11.24 2 argus                                                                                         
> 16754 root      20   0 5791m 5.4g  49m S 16.6 34.1  29:41.79 3 Pfring3                                                                                       
> 16752 root      20   0 5791m 5.4g  49m S 13.3 34.1  30:05.45 1 Pfring1                                                                                       
> 16755 root      20   0 5791m 5.4g  49m S 11.3 34.1  24:06.49 4 Pfring4                                                                                       
> 16757 root      20   0 5791m 5.4g  49m R  9.9 34.1  25:30.74 6 Pfring6                                                                                       
> 16756 root      20   0 5791m 5.4g  49m S  7.6 34.1  27:50.01 5 Pfring5                                                                                       
> 16753 root      20   0 5791m 5.4g  49m S  6.3 34.1  23:36.11 2 Pfring2                                                                                       
> 16758 root      20   0 5791m 5.4g  49m S  3.3 34.1  11:16.54 7 FlowManagerThre                                                                               
> 19501 snort     20   0  360m 280m 3028 S  1.0  1.7   1:06.31 2 argus                     

(the "snort" uid is a - ahem - historical artifact :) )

There's a possibility I made a mess of including Anoop's changes though.
I've attached my version of the patch against git master. Does it look
OK? Having said that, I'd expect it to crash a lot more if it's wrong.

Best Wishes,
Chris

On 27/09/11 16:14, Will Metcalf wrote:
> Yes, that is correct, Victor essentially told me that naming it
> "single" was dumb and confusing but it in a really polite accent name
> /me looks over at large dutch guy in his living room.. I'm operating
> under the assumption that victor is practicing the art of middle
> kingdom diplomacy :)..
> 
> Regards,
> 
> Will
> 
> On Tue, Sep 27, 2011 at 10:11 AM, Martin Holste <mcholste at gmail.com> wrote:
>>> Maybe I just misunderstand you, but runmode single is using a single
>>> packet processing pipeline. If you need more I suggest autofp.
>>>
>> If I understood Will correctly, the single runmode for PF_RING was
>> because PF_RING already does all of the flow distribution, so you want
>> as close to n number of singles as possible to keep all of the threads
>> related to a given flow on the proper CPU.  I don't know if that's
>> been corrected in autofp now.
>> _______________________________________________
>> Oisf-devel mailing list
>> Oisf-devel at openinfosecfoundation.org
>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
>>
> _______________________________________________
> Oisf-devel mailing list
> Oisf-devel at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel

-- 
--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+-
Christopher Wakelin,                           c.d.wakelin at reading.ac.uk
IT Services Centre, The University of Reading,  Tel: +44 (0)118 378 2908
Whiteknights, Reading, RG6 6AF, UK              Fax: +44 (0)118 975 3094
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pf_ring_single.patch
Type: text/x-patch
Size: 4557 bytes
Desc: not available
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20110927/485295dd/attachment.bin>