Project

General

Profile

Actions

Bug #4087

open

excessive CPU usage on Windows with --pcap-file-continuous option

Added by Victor Julien about 4 years ago. Updated 5 months ago.

Status:
New
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

"I'm writing to you for a bug I met on Windows with Suricata. The bug covers version at least 5.0.3 and 6.0.0.
Let's run suricata with command:
suricata -r .\empty_folder --pcap-file-continuous

Actually, there's no file under the folder. And I expect suricata to sleep and sleep, waiting for new incoming files. But the suricata just cost 100% of the CPU. I guess the bug is related to this code:

/src/source-pcap-file-directory-helper.c:
while (status == TM_ECODE_OK) {
//loop while directory is ok
SCLogInfo("Processing pcaps directory s, files must be newer than %" PRIuMAX " and older than %" PRIuMAX,
ptv->filename, (uintmax_t)SCTimespecAsEpochMillis(&ptv->shared->last_processed),
(uintmax_t)SCTimespecAsEpochMillis(&older_than));
status = PcapDirectoryDispatchForTimeRange(ptv, &older_than);
if (ptv->should_loop &x%x
status == TM_ECODE_OK) {
sleep(poll_seconds);
.......

Maybe the sleep() just does nothing on Windows. I'm not sure whether it's the really cause."


Related issues 1 (1 open0 closed)

Related to Suricata - Bug #4370: the latest release of Suricata V6.0.1 for Windows use high CPUNewOISF DevActions
Actions #1

Updated by Victor Julien over 2 years ago

  • Related to Bug #4370: the latest release of Suricata V6.0.1 for Windows use high CPU added
Actions #2

Updated by Philippe Antoine 5 months ago

  • Target version set to TBD
Actions #3

Updated by Philippe Antoine 5 months ago

  • Assignee set to Community Ticket
Actions

Also available in: Atom PDF