[Oisf-users] FlowManagerThread idle CPU usage

[Victor Julien]

On 21-03-16 12:05, elof2 at sentor.se wrote:
> Should the FlowManagerThread in Suricata really use CPU resources when
> there are zero captures packets?
> 
> My sensor is completely silent (zero packets on ix1), but 'top -PSHz'
> show a constant CPU utilization of 2.69% for the FlowManagerThread.
> 
> 
> The box itself is idling. No traffic in or out. No SPAN is sent to it.
> So there's just a suricata running, doing nothing.
> Yet, it constantly consumes ~2.7% of one CPU.

This is expected. The flow manager thread is basically a garbage
collector walking a hash table on a interval. The cpu time is related to
the flow hash table size. If there are many flows it will take more CPU,
but it will take some even if the hash is (virtually) empty.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------