[Oisf-users] High CPU usage without any rules

[Andreas Herz]

On 19/11/15 at 10:51, Satish Patel wrote:
> 19/11/2015 -- 10:50:10 - <Info> - 1 rule files processed. 1 rules
> successfully loaded, 0 rules failed

What rule are you using? Is the load issue the same even without this
rule?

> 19/11/2015 -- 10:50:10 - <Warning> - [ERRCODE: SC_ERR_NOT_SUPPORTED(225)] -
> Eve-log support not compiled in. Reconfigure/recompile with libjansson and
> its development files installed to add eve-log support.

You might wanna exclude eve log from the config, but shouldn't be an
issue with the load.

> 19/11/2015 -- 10:50:10 - <Info> - Large Receive Offload is unset on eth1
> 19/11/2015 -- 10:50:10 - <Warning> - [ERRCODE: SC_ERR_PCAP_CREATE(21)] -
> Using Pcap capture with GRO or LRO activated can lead to capture problems.

Regarding this issue, read:

https://redmine.openinfosecfoundation.org/projects/suricata/wiki/File_Extraction

Section NIC Offloading

-- 
Andreas Herz