[Oisf-users] Performance on multiple CPUs

[Gene Albin]

So in that case the I/O becomes the bottleneck?  I've tried to minimize disk
I/O by putting the pcap file into a ramdisk.  Not sure if that makes a
difference or not.  (seems to, though)

Gene

On Mon, Aug 22, 2011 at 2:48 AM, Victor Julien <victor at inliniac.net> wrote:

> On 08/15/2011 06:00 PM, Gene Albin wrote:
> > Anoop,
> >   Indeed.  With 48 CPU's in both runmodes in each max-pending-packets
> > category I average the following across all of my runs:
> >
> > Runmode: Auto
> > MPP     Avg PPS   StDev
> > 50:     27160     590
> > 500:    29969     1629
> > 5000:   31267     356
> > 50000:  31608     358
> >
> > Runmode: AutoFP
> > MPP     Avg PPS   StDev
> > 50:     16924     106
> > 500:    56572     405
> > 5000:   86683     1577
> > 50000:  132936    5548
> >
> >
> >   Just reading over my email I don't think I mentioned the variables that
> > I'm adjusting.  3 variables here.  Runmode, Detect Thread Ratio, and Max
> > Pending Packets.  Each run that I mention above is at a different DTR
> from
> > .1-1.0 then 1.2, 1.5, 1.7, and 2.0.  I was expecting to see something
> along
> > the lines of Eric LeBlond's results on his blog post:
> >
> http://home.regit.org/2011/02/more-about-suricata-multithread-performance/
> > but it doesn't look like changing the DTR gave me the significant
> > performance increase that he reported.  (most likely due to other
> > differences in our .yaml files, i.e. cpu_affinity).
> >
> >   Thank you for the clarification on the relationship between MPP and the
> > cache.  That does clear thing up a bit.  So you think I should be seeing
> > better performance with 48 CPU's than I'm currently getting?  Where do
> you
> > think I can make the improvements?  My first guess would be in
> cpu_affinity,
> > but that's just a guess.
>
> One limitation of the pcap file runmodes is that no matter how many
> cores/threads you throw at it, we still have only a single file reading
> thread that has to feed all the rest.
>
> PF_RING live mode and soon the AF_PACKET fanout live mode allow you to
> have many more packet readers. But only for live modes.
>
> --
> ---------------------------------------------
> Victor Julien
> http://www.inliniac.net/
> PGP: http://www.inliniac.net/victorjulien.asc
> ---------------------------------------------
>
> _______________________________________________
> Oisf-users mailing list
> Oisf-users at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>



-- 
Gene Albin
gene.albin at gmail.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20110822/b1752704/attachment-0002.html>