Reduce timeout in unix-socket when multiple pcaps are enqueued
This is a small optimization for runmode unix-socket. Whenever a pcap is sent to the socket, the timeout for polling new pcaps is reduced. If there are no more pcaps in queue, the timeout is reset to standard value.
In this way Suricata can keep up with burst of pcaps, while reducing its CPU time when it doesn't have any work to do.
Updated by Maurizio Abba over 4 years ago
Victor Julien wrote:
Is this related to #2221?
Slightly. This is a simpler version of this optimization, avoiding to use yet another thread. I feel this to be a good middleground between a complex decoupled polling system and the current issue with fixed timeouts.