[Oisf-users] [EXT] Re: Packet loss and increased resource consumption after upgrade to 4.1.2 with Rust support

[Peter Manev]

On Wed, Feb 20, 2019 at 3:31 PM Cloherty, Sean E <scloherty at mitre.org> wrote:
>
> So do this with 4.1.2, right?

Yes please!

>
> -----Original Message-----
> From: Peter Manev <petermanev at gmail.com>
> Sent: Wednesday, February 20, 2019 9:27 AM
> To: Cloherty, Sean E <scloherty at mitre.org>
> Cc: Eric Urban <eurban at umn.edu>; Open Information Security Foundation <oisf-users at lists.openinfosecfoundation.org>
> Subject: Re: [EXT] Re: [Oisf-users] Packet loss and increased resource consumption after upgrade to 4.1.2 with Rust support
>
> On Wed, Feb 20, 2019 at 3:01 PM Cloherty, Sean E <scloherty at mitre.org> wrote:
> >
> > Peter -
> >
> > * CentOS Linux release 7.6.1810 / 3.10.0-957.1.3.el7.x86_64 #1 SMP Thu
> > Nov 29 14:49:43 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
> > * Rust is rust-1.30.0-x86_64
> > * Hyperscan 4.7.0
> > *Here is the full line I use to build Suricata -
> >
> > ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
> > --with-libhs-libraries=/usr/local/lib/
> > --with-libhs-includes=/usr/local/include/hs/
> > --with-liblzma-includes=/usr/include/lzma/
> > --with-liblzma-libraries=/usr/lib64/ --enable-gccprotect
> > --enable-geoip --enable-lua --enable-profiling --enable-pie
> > --enable-rust --enable-unix-socket
> >
>
> Can you remove "--enable-profiling" form the command line compile, reinstall  and rerun the test? (--enable-rust --enable-unix-socket should be done/checked  by default during build time) Curious if you could please  do that and feedback the results  with all Rust/protos enabled?
>
> Thank you
>
> > Thanks,
> >
> > Sean
> >
> > -----Original Message-----
> > From: Peter Manev <petermanev at gmail.com>
> > Sent: Wednesday, February 20, 2019 5:59 AM
> > To: Cloherty, Sean E <scloherty at mitre.org>
> > Cc: Eric Urban <eurban at umn.edu>; Open Information Security Foundation
> > <oisf-users at lists.openinfosecfoundation.org>
> > Subject: Re: [EXT] Re: [Oisf-users] Packet loss and increased resource
> > consumption after upgrade to 4.1.2 with Rust support
> >
> > On Tue, Feb 19, 2019 at 1:12 AM Cloherty, Sean E <scloherty at mitre.org> wrote:
> > >
> > > When I compiled 4.0.6 on the previously 4.1.2 host, I used the same arguments including Rust.  I think all of the Rust parsers are disabled, but SMB is enabled.  In my case I’ve seen no packet loss in three days despite compiling with Rust.
> > >
> > >
> >
> > Interesting observation and feedback - thank you Sean Sould you please confirm what OS / rust version do you use?
> >
> > Thank you
> >
> >
> > --
> > Regards,
> > Peter Manev
>
>
>
> --
> Regards,
> Peter Manev



-- 
Regards,
Peter Manev