Suricata

In autofp mode and with a multicore box it is possible the reload of rules get stuck between the two following log messages:

[23912] 16/10/2015 -- 15:44:53 - (detect-engine.c:593) <Notice> (DetectEngineReloadThreads) -- rule reload starting
[23912] 16/10/2015 -- 15:44:58 - (detect-engine.c:747) <Notice> (DetectEngineReloadThreads) -- rule reload complete

On a system with 8 cores, the auto mode of af-packet is starting 8 capture threads and this can cause some threads to get stuck in the DetectEngineReloadThreads function looping and waiting for threads to be ready:

@while (!TmThreadsCheckFlag(tv, THV_RUNNING_DONE)) {
     usleep(100);
}@

Or at line detect-engine.c:703

We should check the thread causing the issue and see how we can implement the timoeout as the delay to reload can be really long.