[Oisf-users] Processing threads limit of 16?

[Cooper F. Nelson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sorry to hear that, my condolences.

I'll save you some time and show you how to easily set the IRQ vectors
for the Intel nics on cores 0-30, even cores only.

1.  Stop the irqbalance daemon.

2.  Edit the set_irq_affinity script (this ships with the driver).

Find this line: for VEC in `seq 0 1 $MAX`

..and change it to:

     for VEC in `seq 0 2 30`

Then run the script with the Intel eth device as its argument.

In the suricata.yaml file, set the 'detect-cpu-set' directive as follows:

>     - detect-cpu-set:
>         cpu: [ 1,3,5,7,9,11,13,15,17,19,21,23,25,27,29,31 ]
>         mode: "exclusive" # run detect threads in these cpus
>         # Use explicitely 3 threads and don't compute number by using
>         # detect-thread-ratio variable:
>         #threads: 2
>         prio:
>           default: "high"


- -Coop


On 2/16/2015 9:23 PM, Barkley, Joey wrote:
> Thanks Eric and Coop. I’ve had a death in the family and won’t be able
> to work on this for a few more days, but I’ll try the cluster_flow
> setting (though in my previous attempts that seemed to result in quite a
> high % of kernel_drops) and also the trick Coop talked about with
> setting the cores to even/odd irq balancing. I like that last idea, but
> will be a little tricky.
> 
> 

- -- 
Cooper Nelson
Network Security Analyst
UCSD ACT Security Team
cnelson at ucsd.edu x41042
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)

iQEcBAEBAgAGBQJU44UqAAoJEKIFRYQsa8FWqlsIAL3/5t5JE+YhH3olpoWQ4Q0H
KefEyjLpEEVZQ3gjCwyeEU95Xxs4okWkCkq+JVYiEIpdfkPvYi74IWKOzBpA+LOP
R2hnHjyZavvRbquCbIwcNt1YS0LvsxD0XyIhBqkBx3YQMyZ74y7zGwirxcdKPSlD
L5q3AqBugO076vOpqcr+Wkh071cbARM2jKsMMZNPNfpJHn05O8IhWLos4qIR9P9R
JR74kEWqHZTuhoiy9mg20Ep2hbTccHrj3FxojA2SWXOKZaneXNAXZ2el1w2nLGv3
yi360WVVqV/IpmPheAb55RdpHPTUIqrCm9KIDOi5n48fJaLF51Gu3tyhmLVk0pc=
=OUeN
-----END PGP SIGNATURE-----