[Oisf-users] Compile suricata with Intel icc

[Victor Julien]

On 26-10-18 20:05, Ming Fu wrote:
> I tried to compile Suricata 4.0.5 with Intel icc ((ICC) 19.0.0.117 20180804). I get a suricata binary that will start but it does not seem to process pcap file after compiled the rules. It does not stop either. Similar configured gcc build would exit after processing the pcap file.
> 
> My configure for suricata is:
> ./configure --prefix=/usr/local/suricata-icc --exec-prefix=/usr/local/suricata-icc --sysconfdir=/opt/data/suricata --docdir=/usr/local/suricata-gcc/doc --enable-af-packet --enable-nfqueue --enable-nflog --disable-gccmarch-native --with-libnss-includes=/usr/include/nss --with-libnspr-includes=/usr/include/nspr --disable-coccinelle --with-libhs-includes=/opt/pkgs/libhyperscan5/include/hs --with-libhs-libraries=/opt/pkgs/libhyperscan5/lib --enable-geoip --enable-hiredis CC=/opt/intel/bin/icc CXX=/opt/intel/bin/icpc
> 
> When Run ICC compiled Suricata:
> ========================================================================================
> /usr/local/suricata-icc/bin/suricata -r /mnt/ram/l.pcap -c /opt/conf/suricata/vsniff1/common/vsniff1.yaml 
> 26/10/2018 -- 17:37:12 - <Info> - Including configuration file vars.yaml at parent node vars.
> 26/10/2018 -- 17:37:12 - <Notice> - This is Suricata version 4.0.5 RELEASE
> ^CKilled
> 
> Was killed as it won't exit itself for very long time, the Suricata-Main thread consumes less than a few percent of CPU circles. The other threads do not appear on top at all.
> 
> When Run gcc compiled Suricata:
> ========================================================================================
> Ming root at cyclops-9661:~$ /usr/local/suricata-gcc/bin/suricata -r /mnt/ram/l.pcap -c /opt/conf/suricata/vsniff1/common/vsniff1.yaml 
> 26/10/2018 -- 17:40:28 - <Info> - Including configuration file vars.yaml at parent node vars.
> 26/10/2018 -- 17:40:28 - <Notice> - This is Suricata version 4.0.5 RELEASE
> 26/10/2018 -- 17:41:26 - <Notice> - all 4 packet processing threads, 4 management threads initialized, engine started.
> 26/10/2018 -- 17:43:58 - <Notice> - Signal Received.  Stopping engine.
> 26/10/2018 -- 17:44:07 - <Notice> - Pcap-file module read 50779115 packets, 39299334786 bytes
> 
> Anyone has experience compile with Intel ICC? Do you gain extra performance when compile with ICC?

I've played a bit with icc a few years ago, but didn't see this issue. I
haven't done benchmarks at the time, as I was mostly interested making
sure the code would compile and perhaps new interesting warnings could
get fixed.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------