[Oisf-users] Suricata with IRQBalance

[Peter Manev]

On Sun, May 29, 2016 at 1:57 AM, Duarte Silva
<duarte.silva at serializing.me> wrote:
>
> Hey,
>
>
>
> in irqbalance, you have to blacklist the IRQs used by the network card. Then you have to set the IRQ CPU affinity correctly. Then you have to configure suricata threading and CPU affinity settings.
>
>
>
> These are guidelines that I follow to setup suri. If you need more help, as Andreas stated, we need more info (rin mode, configd, etc.)

Nic model, drivers version etc...would also help. Have you run the irq
affinity script usually provided in the driver sources?


>
>
>
> Cheers
>
>
>
> De: Andreas Herz
> Enviado: 29 de maio de 2016 00:32
> Para: oisf-users at lists.openinfosecfoundation.org
> Assunto: Re: [Oisf-users] Suricata with IRQBalance
>
>
>
> On 23/05/16 at 19:27, Yasha Zislin wrote:
>
> > Does anybody use IRQBalance to ballance interrupts for nic processing?
>
>
>
> Peter Manev knows more about IRQs :)
>
>
>
> > I have set up IRQBalance service (in CentOS).
>
> >
>
> > After viewing stats in /proc/interrupts, I feel like it is not working.
>
> >
>
> >             CPU0     CPU1   CPU2    CPU3
>
> >
>
> > 56:          0          0          0  337763094   PCI-MSI-edge      eth0
>
> >  57:          0          0          0          0            PCI-MSI-edge      eth0:1
>
> >  58:          0          0          0          0            PCI-MSI-edge      eth0:2
>
> >  59:          0          0          0          0            PCI-MSI-edge      eth0:3
>
> >
>
> > It looks like only one CPU is doing the work here. Am I correct?
>
>
>
> How did you do the setup?
>
>
>
> > In the past I have tried configuring affinity in Suricata config and had hard time since Packet Loss would even get worse.
>
> >
>
> > Are there any guides on how to configure CPU interrupts for Suricata? I feel like I am loosing performance here.
>
>
>
> Do you have any more details about that behaviour?
>
> Which version are you running in what capture/runmode?
>
>
>
> >
>
> > Thank you.
>
>
>
> > _______________________________________________
>
> > Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
>
> > Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
>
> > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
> > Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net
>
>
>
>
>
> --
>
> Andreas Herz
>
> _______________________________________________
>
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
>
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
>
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
> Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net
>
>
>
> e" UnhideWhenUsed="true" Name="envelope address"/> <w:LsdException Locked="false" SemiHidden="true" UnhideWhenUsed="t
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net




-- 
Regards,
Peter Manev