[Oisf-users] Runmode workers (was: autofp vs auto)
elof2 at sentor.se
elof2 at sentor.se
Thu Mar 10 15:25:11 UTC 2016
Hi!
On Mon, 30 Nov 2015, Victor Julien wrote:
> In short: don't use auto.
>
> In general we recommend workers instead of autofp, so I suggest going
> for that.
...and today, Oliver Humpage wrote:
>> recommended runmode?
> Default of autofp works fine here. worker specifically won’t work IIRC.
Two contradicting recommendations...
Suricata.yaml use autofp per default if you don't manually specify
workers.
So what gives?
Should I use autofp or workers on FreeBSD sensors with netmap and intel
10GE NICs?
I assume the answer is "workers".
Then my immediate question is:
Why don't the default suricata.yaml use "workers" if it is recommended?
/Elof
More information about the Oisf-users
mailing list