Project

General

Profile

Actions

Feature #352

closed

Switching to message queuing system for output

Added by Eric Leblond over 12 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:

Description

Actual threading model consider output modules as standard functions which are run synchronously in the life of a packet inside suricata. But logging functions involve I/O on disk or on the network. They thus can be really time expensive.
There is a potential performance issue there because, the building the alert message trigger the locking of ressources like flow. It will thus be interesting to switch:
  • to asynchrounous I/O operation OR
  • to a message queuing system where an alert structure build from a copy of information is sent to the output modules.
Actions

Also available in: Atom PDF