[Oisf-users] Processing threads limit of 16?

[Barkley, Joey]

I gave this a shot but never could quite make it work. I still only had data logging in the stats log on the first 16 cores (even though I had specified even numbered cores from 0-30). But that’s OK as I am still having RAM usage issues anyway. I think my processing is relatively stable at this point with all the configuration changes all of you have suggested in other threads. I’m just trying to tweak now and reduce my RAM usage so I can possibly run another instance of Suricata and use 16 more cores.

Thanks again for all the help!


> On Feb 17, 2015, at 12:15 PM, Cooper F. Nelson <cnelson at ucsd.edu> wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Sorry to hear that, my condolences.
> 
> I'll save you some time and show you how to easily set the IRQ vectors
> for the Intel nics on cores 0-30, even cores only.
> 
> 1.  Stop the irqbalance daemon.
> 
> 2.  Edit the set_irq_affinity script (this ships with the driver).
> 
> Find this line: for VEC in `seq 0 1 $MAX`
> 
> ..and change it to:
> 
>     for VEC in `seq 0 2 30`
> 
> Then run the script with the Intel eth device as its argument.
> 
> In the suricata.yaml file, set the 'detect-cpu-set' directive as follows:
> 
>>    - detect-cpu-set:
>>        cpu: [ 1,3,5,7,9,11,13,15,17,19,21,23,25,27,29,31 ]
>>        mode: "exclusive" # run detect threads in these cpus
>>        # Use explicitely 3 threads and don't compute number by using
>>        # detect-thread-ratio variable:
>>        #threads: 2
>>        prio:
>>          default: "high"
> 
> 
> - -Coop
> 
> 
> On 2/16/2015 9:23 PM, Barkley, Joey wrote:
>> Thanks Eric and Coop. I’ve had a death in the family and won’t be able
>> to work on this for a few more days, but I’ll try the cluster_flow
>> setting (though in my previous attempts that seemed to result in quite a
>> high % of kernel_drops) and also the trick Coop talked about with
>> setting the cores to even/odd irq balancing. I like that last idea, but
>> will be a little tricky.
>> 
>> 
> 
> - -- 
> Cooper Nelson
> Network Security Analyst
> UCSD ACT Security Team
> cnelson at ucsd.edu x41042
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.17 (MingW32)
> 
> iQEcBAEBAgAGBQJU44UqAAoJEKIFRYQsa8FWqlsIAL3/5t5JE+YhH3olpoWQ4Q0H
> KefEyjLpEEVZQ3gjCwyeEU95Xxs4okWkCkq+JVYiEIpdfkPvYi74IWKOzBpA+LOP
> R2hnHjyZavvRbquCbIwcNt1YS0LvsxD0XyIhBqkBx3YQMyZ74y7zGwirxcdKPSlD
> L5q3AqBugO076vOpqcr+Wkh071cbARM2jKsMMZNPNfpJHn05O8IhWLos4qIR9P9R
> JR74kEWqHZTuhoiy9mg20Ep2hbTccHrj3FxojA2SWXOKZaneXNAXZ2el1w2nLGv3
> yi360WVVqV/IpmPheAb55RdpHPTUIqrCm9KIDOi5n48fJaLF51Gu3tyhmLVk0pc=
> =OUeN
> -----END PGP SIGNATURE-----
>