Project

General

Profile

Actions

Optimization #2460

open

Reduce timeout in unix-socket when multiple pcaps are enqueued

Added by Maurizio Abba over 4 years ago. Updated over 4 years ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

This is a small optimization for runmode unix-socket. Whenever a pcap is sent to the socket, the timeout for polling new pcaps is reduced. If there are no more pcaps in queue, the timeout is reset to standard value.
In this way Suricata can keep up with burst of pcaps, while reducing its CPU time when it doesn't have any work to do.

Actions #1

Updated by Victor Julien over 4 years ago

Is this related to #2221?

Actions #2

Updated by Maurizio Abba over 4 years ago

Victor Julien wrote:

Is this related to #2221?

Slightly. This is a simpler version of this optimization, avoiding to use yet another thread. I feel this to be a good middleground between a complex decoupled polling system and the current issue with fixed timeouts.

Actions #3

Updated by Andreas Herz over 4 years ago

  • Target version set to TBD

Can you post the new PR with a link here?

Actions

Also available in: Atom PDF