[Oisf-users] Suricata with IRQBalance

[Cooper F. Nelson]

Try reloading your NIC kernel module and restarting IRQ balance.

I know I've seen it get 'stuck' on occasion, so I have a script to do
the above prior to launching suricata.

-Coop

On 5/23/2016 12:27 PM, Yasha Zislin wrote:
> Does anybody use IRQBalance to ballance interrupts for nic processing?
> 
> I have set up IRQBalance service (in CentOS).
> 
> After viewing stats in /proc/interrupts, I feel like it is not working.
> 
>             CPU0     CPU1   CPU2    CPU3
> 
> 56:          0          0          0  337763094   PCI-MSI-edge      eth0
>  57:          0          0          0          0            PCI-MSI-edge      eth0:1
>  58:          0          0          0          0            PCI-MSI-edge      eth0:2
>  59:          0          0          0          0            PCI-MSI-edge      eth0:3
> 
> It looks like only one CPU is doing the work here. Am I correct?
> 
> In the past I have tried configuring affinity in Suricata config and had hard time since Packet Loss would even get worse.
> 
> Are there any guides on how to configure CPU interrupts for Suricata? I feel like I am loosing performance here.
> 
> 
> Thank you.
> 
> 
> 
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net
> 


-- 
Cooper Nelson
Network Security Analyst
UCSD ITS Security Team
cnelson at ucsd.edu x41042

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20160530/44c9d7b4/attachment-0002.sig>