[Oisf-users] Suricata on 8 cores, ~70K packets/sec

[Chris Wakelin]

On 15/02/11 20:19, Chris Wakelin wrote:

> 
> I've just stopped Suricata again; this time it got
> 
>> [8492] 15/2/2011 -- 20:12:15 - (stream-tcp-reassemble.c:352) <Info> (StreamTcpReassembleFree) -- Max memuse of the stream reassembly engine 268435456 (in use 0)
> 
> which I guess means it ran out again ...
> 

I've tried increasing the stream reassembly memcap to 512mb, and it
still seems to use it all. I've not had any flow emergency mode recently
though.

>> [8492] 15/2/2011 -- 20:12:16 - (stream-tcp.c:466) <Info> (StreamTcpFreeConfig) -- Max memuse of stream engine 41353200 (in use 0)
> 
> ... but that one didn't.

perhaps that's why it was leaking flows (or maybe just the decreased
flow timeout helped)?

> 
> Again, the decode1 thread ended up using all its CPU and the packet
> count dropped to 5-6K per second. Strangely, I've not seen that before
> today.

I've rebooted this server since (needed to turn on I/OAT in the BIOS)
and it seems to have behaved since in this respect.

Best Wishes,
Chris

-- 
--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+-
Christopher Wakelin,                           c.d.wakelin at reading.ac.uk
IT Services Centre, The University of Reading,  Tel: +44 (0)118 378 8439
Whiteknights, Reading, RG6 6AF, UK              Fax: +44 (0)118 975 3094