Bug #50
closedtime based stats are not calculated correctly
Description
This is after a runtime of 19 seconds:
decoder.pkts | Decode1 | 1384407
decoder.pkts_per_sec | Decode1 | 7689.232558
decoder.bytes | Decode1 | 1423315351
decoder.bytes_per_sec | Decode1 | 7967362.790698
decoder.mbit_per_sec | Decode1 | 63.738902
1384407 / 19 = 72863 pkt/s
1423315351 / 19 = 74811334 bytes/s
mbit/s value should be in the 550-570 range...
Above was in pcap file reading mode.
Files
Updated by Anoop Saldanha about 14 years ago
- File 0001-Fix-for-bug-50.-Make-timebased-counters-more-accura.patch 0001-Fix-for-bug-50.-Make-timebased-counters-more-accura.patch added
Victor Julien wrote:
This is after a runtime of 19 seconds:
decoder.pkts | Decode1 | 1384407
decoder.pkts_per_sec | Decode1 | 7689.232558
decoder.bytes | Decode1 | 1423315351
decoder.bytes_per_sec | Decode1 | 7967362.790698
decoder.mbit_per_sec | Decode1 | 63.7389021384407 / 19 = 72863 pkt/s
1423315351 / 19 = 74811334 bytes/s
mbit/s value should be in the 550-570 range...Above was in pcap file reading mode.
The values shown are the instataneous values and not for the entire period. For example before the counters api logs values to the file, it takes the accumulated local values, and the time over which these values were calcualted and calculates the accumu_local_value/time and then resets the global counter value to 0.
Attached is a patch which makes the values given by timebased counters more accurate.
Updated by Victor Julien about 14 years ago
When reading a pcap things seem to be off still. It processes 1.3M packets in 106sec, so an average 12k per second. Yet what I'm seeing is:
$ grep pkts_per_sec /var/log/suricata/stats.log
decoder.pkts_per_sec | Decode1 | 13445.545455
decoder.pkts_per_sec | Decode1 | 590.200000
decoder.pkts_per_sec | Decode1 | 630.909091
decoder.pkts_per_sec | Decode1 | 694.285714
decoder.pkts_per_sec | Decode1 | 642.545455
decoder.pkts_per_sec | Decode1 | 476.909091
decoder.pkts_per_sec | Decode1 | 724.555556
decoder.pkts_per_sec | Decode1 | 827.000000
decoder.pkts_per_sec | Decode1 | 758.571429
decoder.pkts_per_sec | Decode1 | 800.333333
decoder.pkts_per_sec | Decode1 | 885.285714
decoder.pkts_per_sec | Decode1 | 824.666667
decoder.pkts_per_sec | Decode1 | 580.166667
decoder.pkts_per_sec | Decode1 | inf
decoder.pkts_per_sec | Decode1 | inf
decoder.pkts_per_sec | Decode1 | 1273.486726
Updated by Victor Julien about 14 years ago
- Due date changed from 01/31/2010 to 03/13/2010
- Target version changed from 0.8.1 to 0.8.2
Updated by Victor Julien about 14 years ago
- Due date changed from 03/13/2010 to 04/30/2010
- Target version changed from 0.8.2 to 0.9.0
Updated by Victor Julien almost 14 years ago
- Target version changed from 0.9.0 to 0.9.1
Updated by Victor Julien almost 14 years ago
- Target version changed from 0.9.1 to 0.9.2
Updated by Victor Julien almost 14 years ago
- Due date changed from 04/30/2010 to 06/21/2010
- Target version changed from 0.9.2 to 0.9.3
- Estimated time changed from 2.50 h to 5.00 h
Updated by Victor Julien almost 14 years ago
- Due date changed from 06/21/2010 to 06/28/2010
- Target version changed from 0.9.3 to 1.0.0
- Estimated time changed from 5.00 h to 8.00 h
Updated by Victor Julien almost 14 years ago
- Target version changed from 1.0.0 to 1.0.1
I've disabled the counters that are affected.
Updated by Victor Julien over 13 years ago
- Status changed from New to Closed
- % Done changed from 0 to 100
Counter redesign will be a separate task. Closing this bug.