[Oisf-users] suricata 4 af-packet threads: auto

Victor Julien lists at inliniac.net
Wed Aug 30 08:23:44 UTC 2017

On 29-08-17 17:29, erik clark wrote:
> Setting threads: auto in af-packet section does not actually set the
> number of threads to the number of cores on the box (or at least it
> doesn't in my environment). It simply sets it to 1 thread. I manually
> configured it to run 32 threads, but was expecting to see auto set it to
> 64 threads. Not sure why this isn't being respected?

What's your cluster-type setting?

If cluster_flow the cpu core count should be used.

If cluster_qm the RSS queue count should be used.

Start up messages should give some more info if log level is increased
to 'perf' (just add a bunch of -vvvv's)

Victor Julien
PGP: http://www.inliniac.net/victorjulien.asc

More information about the Oisf-users mailing list