Actions
Optimization #2460
openReduce timeout in unix-socket when multiple pcaps are enqueued
Effort:
Difficulty:
Label:
Description
This is a small optimization for runmode unix-socket. Whenever a pcap is sent to the socket, the timeout for polling new pcaps is reduced. If there are no more pcaps in queue, the timeout is reset to standard value.
In this way Suricata can keep up with burst of pcaps, while reducing its CPU time when it doesn't have any work to do.
Updated by Maurizio Abba about 6 years ago
Victor Julien wrote:
Is this related to #2221?
Slightly. This is a simpler version of this optimization, avoiding to use yet another thread. I feel this to be a good middleground between a complex decoupled polling system and the current issue with fixed timeouts.
Updated by Andreas Herz about 6 years ago
- Target version set to TBD
Can you post the new PR with a link here?
Updated by Victor Julien 11 months ago
- Assignee changed from Maurizio Abba to Community Ticket
Actions