Actions
Feature #352
closed
EL
Switching to message queuing system for output
Feature #352:
Switching to message queuing system for output
Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:
Description
Actual threading model consider output modules as standard functions which are run synchronously in the life of a packet inside suricata. But logging functions involve I/O on disk or on the network. They thus can be really time expensive.
There is a potential performance issue there because, the building the alert message trigger the locking of ressources like flow. It will thus be interesting to switch:
There is a potential performance issue there because, the building the alert message trigger the locking of ressources like flow. It will thus be interesting to switch:
- to asynchrounous I/O operation OR
- to a message queuing system where an alert structure build from a copy of information is sent to the output modules.
Actions