Bug #382

Suricata uses 100% of CPU on some virtual system

Added by Eric Leblond over 2 years ago. Updated over 2 years ago.

Status:ClosedStart date:11/24/2011
Priority:NormalDue date:
Assignee:Eric Leblond% Done:

100%

Category:-Estimated time:8.00 hours
Target version:1.2beta1

Description

Due to some call to usleep with low value, suricata causes an important load on some virtual system.

The attached patch fixes the issue but should have some severe implication on performance. Thus it only indicate where to look at.

0001-TEST-increase-sleep-time-in-usleep-call.patch Magnifier (3.77 KB) Eric Leblond, 11/24/2011 10:31 AM

0001-Flow-use-condition-system-instead-of-short-sleep.patch Magnifier (6.51 KB) Eric Leblond, 11/30/2011 02:34 AM

History

#1 Updated by Eric Leblond over 2 years ago

  • Assignee set to Eric Leblond

#2 Updated by Peter Manev over 2 years ago

Eric,

When does this occur? Any specific situation ?
What is your VM setup ? (mem,cpu,os).

Thanks

#3 Updated by Eric Leblond over 2 years ago

Peter,

The problem can be reproduced on a VirtualBox system (Host is a debian sid).

This is linked with a usleep(10) call in the flow manager. I've proposed a patch to Victor and Anoop which are currently reviewing it. The patch is attached to this comment.

#4 Updated by Anoop Saldanha over 2 years ago

has the current master fixed this issue?

#5 Updated by Eric Leblond over 2 years ago

  • % Done changed from 80 to 90

Current master does not show the issue on my VM.

#6 Updated by Victor Julien over 2 years ago

  • Status changed from Assigned to Closed
  • Target version set to 1.2beta1
  • % Done changed from 90 to 100

Also available in: Atom PDF