[Oisf-users] suricata 4 af-packet threads: auto

[Victor Julien]

On 29-08-17 17:29, erik clark wrote:
> Setting threads: auto in af-packet section does not actually set the
> number of threads to the number of cores on the box (or at least it
> doesn't in my environment). It simply sets it to 1 thread. I manually
> configured it to run 32 threads, but was expecting to see auto set it to
> 64 threads. Not sure why this isn't being respected?

What's your cluster-type setting?

If cluster_flow the cpu core count should be used.

If cluster_qm the RSS queue count should be used.

Start up messages should give some more info if log level is increased
to 'perf' (just add a bunch of -vvvv's)

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------