[Oisf-users] Suricata with IRQBalance

[Yasha Zislin]

I have HP NC522SFP 10 gig card. I cant seem to find any smp affinity scripts for it. Everything that I find is for Intel cards.

So I've managed manually to set SMP affinity (I think that's what affinity script does).

I now see this:

56:  196392516     279411  170491518 3411880048   PCI-MSI-edge      eth0
 57:          0          0          0          0   PCI-MSI-edge      eth0:1
 58:          0          0          0          0   PCI-MSI-edge      eth0:2
 59:          0          0          0          0   PCI-MSI-edge      eth0:3

What are the other 3 IRQs used for (eth0:1, eth0:2, eth0:3)? Am I supposed to get hits on that as well.

Even though I found another process which was hogging one of the CPUs, packet loss has not been eliminated.
I only have couple of million packets per minute and 30% packet loss.

________________________________________
From: Oisf-users <oisf-users-bounces at lists.openinfosecfoundation.org> on behalf of Peter Manev <petermanev at gmail.com>
Sent: Monday, May 30, 2016 6:54 AM
To: Duarte Silva
Cc: oisf-users at lists.openinfosecfoundation.org
Subject: Re: [Oisf-users] Suricata with IRQBalance

On Sun, May 29, 2016 at 1:57 AM, Duarte Silva
<duarte.silva at serializing.me> wrote:
>
> Hey,
>
>
>
> in irqbalance, you have to blacklist the IRQs used by the network card. Then you have to set the IRQ CPU affinity correctly. Then you have to configure suricata threading and CPU affinity settings.
>
>
>
> These are guidelines that I follow to setup suri. If you need more help, as Andreas stated, we need more info (rin mode, configd, etc.)

Nic model, drivers version etc...would also help. Have you run the irq
affinity script usually provided in the driver sources?


>
>
>
> Cheers
>
>
>
> De: Andreas Herz
> Enviado: 29 de maio de 2016 00:32
> Para: oisf-users at lists.openinfosecfoundation.org
> Assunto: Re: [Oisf-users] Suricata with IRQBalance
>
>
>
> On 23/05/16 at 19:27, Yasha Zislin wrote:
>
> > Does anybody use IRQBalance to ballance interrupts for nic processing?
>
>
>
> Peter Manev knows more about IRQs :)
>
>
>
> > I have set up IRQBalance service (in CentOS).
>
> >
>
> > After viewing stats in /proc/interrupts, I feel like it is not working.
>
> >
>
> >             CPU0     CPU1   CPU2    CPU3
>
> >
>
> > 56:          0          0          0  337763094   PCI-MSI-edge      eth0
>
> >  57:          0          0          0          0            PCI-MSI-edge      eth0:1
>
> >  58:          0          0          0          0            PCI-MSI-edge      eth0:2
>
> >  59:          0          0          0          0            PCI-MSI-edge      eth0:3
>
> >
>
> > It looks like only one CPU is doing the work here. Am I correct?
>
>
>
> How did you do the setup?
>
>
>
> > In the past I have tried configuring affinity in Suricata config and had hard time since Packet Loss would even get worse.
>
> >
>
> > Are there any guides on how to configure CPU interrupts for Suricata? I feel like I am loosing performance here.
>
>
>
> Do you have any more details about that behaviour?
>
> Which version are you running in what capture/runmode?
>
>
>
> >
>
> > Thank you.
>
>
>
> > _______________________________________________
>
> > Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
>
> > Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
>
> > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
> > Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net
>
>
>
>
>
> --
>
> Andreas Herz
>
> _______________________________________________
>
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
>
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
>
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
> Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net
>
>
>
> e" UnhideWhenUsed="true" Name="envelope address"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="t
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net




--
Regards,
Peter Manev
_______________________________________________
Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net