Project

General

Profile

Actions

Optimization #4234

open

Filemagic logging puts big pressure on performance

Added by Peter Manev over 3 years ago. Updated 9 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
-
Effort:
Difficulty:
Label:

Description

I have observed this with basically any of the 2 major stable versions plus latest git master.
This is not reproducible as a pcap or copy paste config example but rather in the following manner:

When filemagic (as part of fileinfo logs) is enabled on a busy system that has been tuned and the CPUs are not pegged, running with no drops - that immediately results in drops.
It is not necessarily that the CPUs or perf top will expose the problem in terms of busy function.

A way to observe this is with Trex or pktgen setup for example.
I can share examples.

Similar issue is observed when enabling checksums in fileinfo.


Related issues 1 (1 open0 closed)

Related to Suricata - Feature #5894: file: file classification keywordFeedbackVictor JulienActions
Actions #1

Updated by Victor Julien over 1 year ago

Is this still relevant? If so, can you provide more info on the test?

Actions #2

Updated by Victor Julien about 1 year ago

  • Related to Feature #5894: file: file classification keyword added
Actions #3

Updated by Philippe Antoine 9 months ago

  • Assignee set to Peter Manev
Actions

Also available in: Atom PDF