Project

General

Profile

Actions

Support #2476

closed

Eve-log output data

Added by Ron Smith over 6 years ago. Updated almost 6 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
Label:

Description

I have compiled suricata with netmap as well as pf_ring. When i tried both capture mode surprisingly with same other configurations their eve-log output is lot different. PF_Ring eve-log output is appx 10x than netmap.
RSS value in both case is 1.
eve-log output to redis list.
eve-log output stats.capture.kernel_drop value is zero in case of netmap while in case of pf_ring value is greater than 1.
After engine stopped, PF_Ring stats says drop percentage is appx. 40% with data rate 5-10gbps, while in case of netmap i got an error
ERRCODE: S_ERROR_FATAL(171) Engine unable to disable to detect thread - 'w#02-ens192' killing engine

Can anybody help me what i am doing wrong?


Files

eve_output.png (12.2 KB) eve_output.png Number of output json(PF_Ring Vs Netmap) Ron Smith, 04/08/2018 07:32 AM
netmap_capture_stats.png (56.9 KB) netmap_capture_stats.png Netmap stats.capture Ron Smith, 04/08/2018 07:32 AM
netmap_exit.png (46.2 KB) netmap_exit.png Netmap exit error Ron Smith, 04/08/2018 07:32 AM
pf_ring_capture_stats.png (11.9 KB) pf_ring_capture_stats.png PF_RING stats.capture Ron Smith, 04/08/2018 07:32 AM
netmap_cpu.png (361 KB) netmap_cpu.png Netmap cpu usage Ron Smith, 04/08/2018 07:32 AM
pf_ring_exit.png (47.2 KB) pf_ring_exit.png Netmap exit stats Ron Smith, 04/08/2018 07:32 AM
pf_ring_cpu.png (273 KB) pf_ring_cpu.png PF_RING cpu usage Ron Smith, 04/08/2018 07:32 AM
suricata.yaml (66.5 KB) suricata.yaml Suricata YAML file for both Netmap & PF_RING Ron Smith, 04/08/2018 07:32 AM
suricata_build_info.txt (3.05 KB) suricata_build_info.txt 'suricata --build-info' cmd output Ron Smith, 04/08/2018 07:54 AM
Actions

Also available in: Atom PDF