[Oisf-users] Compile suricata with Intel icc

[Ming Fu]

Hi,

I tried to compile Suricata 4.0.5 with Intel icc ((ICC) 19.0.0.117 20180804). I get a suricata binary that will start but it does not seem to process pcap file after compiled the rules. It does not stop either. Similar configured gcc build would exit after processing the pcap file.

My configure for suricata is:
./configure --prefix=/usr/local/suricata-icc --exec-prefix=/usr/local/suricata-icc --sysconfdir=/opt/data/suricata --docdir=/usr/local/suricata-gcc/doc --enable-af-packet --enable-nfqueue --enable-nflog --disable-gccmarch-native --with-libnss-includes=/usr/include/nss --with-libnspr-includes=/usr/include/nspr --disable-coccinelle --with-libhs-includes=/opt/pkgs/libhyperscan5/include/hs --with-libhs-libraries=/opt/pkgs/libhyperscan5/lib --enable-geoip --enable-hiredis CC=/opt/intel/bin/icc CXX=/opt/intel/bin/icpc

When Run ICC compiled Suricata:
========================================================================================
/usr/local/suricata-icc/bin/suricata -r /mnt/ram/l.pcap -c /opt/conf/suricata/vsniff1/common/vsniff1.yaml 
26/10/2018 -- 17:37:12 - <Info> - Including configuration file vars.yaml at parent node vars.
26/10/2018 -- 17:37:12 - <Notice> - This is Suricata version 4.0.5 RELEASE
^CKilled

Was killed as it won't exit itself for very long time, the Suricata-Main thread consumes less than a few percent of CPU circles. The other threads do not appear on top at all.

When Run gcc compiled Suricata:
========================================================================================
Ming root at cyclops-9661:~$ /usr/local/suricata-gcc/bin/suricata -r /mnt/ram/l.pcap -c /opt/conf/suricata/vsniff1/common/vsniff1.yaml 
26/10/2018 -- 17:40:28 - <Info> - Including configuration file vars.yaml at parent node vars.
26/10/2018 -- 17:40:28 - <Notice> - This is Suricata version 4.0.5 RELEASE
26/10/2018 -- 17:41:26 - <Notice> - all 4 packet processing threads, 4 management threads initialized, engine started.
26/10/2018 -- 17:43:58 - <Notice> - Signal Received.  Stopping engine.
26/10/2018 -- 17:44:07 - <Notice> - Pcap-file module read 50779115 packets, 39299334786 bytes

Anyone has experience compile with Intel ICC? Do you gain extra performance when compile with ICC?

Thanks
Ming