[Oisf-users] Processing threads limit of 16?

[Barkley, Joey]

All,

I have made significant progress in tuning our suricata instance to handle our network traffic. Thanks to everyone who has helped me.

Question: Regardless of how many threads I configure, suricata only shows kernel_packets and kernel_drops for the first 16 threads. Is there a hard limit of 16 “usable” threads? My system has 64 cores but it doesn’t seem like I’m able to use more than 16 cores. Have I just configured something incorrectly? I have primarily followed advice on this list and also on http://pevma.blogspot.se/2013/12/suricata-and-grand-slam-of-open-source_8.html for AF_PACKET configuration. Would it help for me to assign my management-cpu-set to different cores than my detect-cpu-set? I seem to remember reading that would not be good as it would adversely impact performance. Or possibly, would increasing the detect-thread-ratio work? I’m using cluster_cpu and not sure how that would be affected by changing those settings.

Advice welcome.

Thanks,
Joey
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20150213/1ccfda27/attachment.html>