[Oisf-users] Suricata with IRQBalance

[Peter Manev]

On Mon, May 30, 2016 at 6:44 PM, Cooper F. Nelson <cnelson at ucsd.edu> wrote:
> Try reloading your NIC kernel module and restarting IRQ balance.
>

So - you use irqbalance ? (I always disable it)
Have you seen any benefit contra using just the affinity script ?

> I know I've seen it get 'stuck' on occasion, so I have a script to do
> the above prior to launching suricata.
>
> -Coop
>
> On 5/23/2016 12:27 PM, Yasha Zislin wrote:
>> Does anybody use IRQBalance to ballance interrupts for nic processing?
>>
>> I have set up IRQBalance service (in CentOS).
>>
>> After viewing stats in /proc/interrupts, I feel like it is not working.
>>
>>             CPU0     CPU1   CPU2    CPU3
>>
>> 56:          0          0          0  337763094   PCI-MSI-edge      eth0
>>  57:          0          0          0          0            PCI-MSI-edge      eth0:1
>>  58:          0          0          0          0            PCI-MSI-edge      eth0:2
>>  59:          0          0          0          0            PCI-MSI-edge      eth0:3
>>
>> It looks like only one CPU is doing the work here. Am I correct?
>>
>> In the past I have tried configuring affinity in Suricata config and had hard time since Packet Loss would even get worse.
>>
>> Are there any guides on how to configure CPU interrupts for Suricata? I feel like I am loosing performance here.
>>
>>
>> Thank you.
>>
>>
>>
>> _______________________________________________
>> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
>> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
>> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>> Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net
>>
>
>
> --
> Cooper Nelson
> Network Security Analyst
> UCSD ITS Security Team
> cnelson at ucsd.edu x41042
>
>
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net



-- 
Regards,
Peter Manev