Bug #50: time based stats are not calculated correctly - Suricata - Open Information Security Foundation

Actions

Bug #50

closed

time based stats are not calculated correctly

Added by Victor Julien almost 15 years ago. Updated over 14 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Target version:

Affected Versions:

Effort:

Difficulty:

Label:

Description

This is after a runtime of 19 seconds:

decoder.pkts | Decode1 | 1384407
decoder.pkts_per_sec | Decode1 | 7689.232558
decoder.bytes | Decode1 | 1423315351
decoder.bytes_per_sec | Decode1 | 7967362.790698
decoder.mbit_per_sec | Decode1 | 63.738902

1384407 / 19 = 72863 pkt/s
1423315351 / 19 = 74811334 bytes/s
mbit/s value should be in the 550-570 range...

Above was in pcap file reading mode.

Files

0001-Fix-for-bug-50.-Make-timebased-counters-more-accura.patch (9.19 KB) 0001-Fix-for-bug-50.-Make-timebased-counters-more-accura.patch

Anoop Saldanha, 02/18/2010 02:19 PM

Actions

#1

Updated by Victor Julien almost 15 years ago

Target version set to 0.8.1

Actions

#2

Updated by Victor Julien almost 15 years ago

Due date set to 01/31/2010

Actions

#3

Updated by Anoop Saldanha almost 15 years ago

File 0001-Fix-for-bug-50.-Make-timebased-counters-more-accura.patch 0001-Fix-for-bug-50.-Make-timebased-counters-more-accura.patch added

Victor Julien wrote:

This is after a runtime of 19 seconds:

decoder.pkts | Decode1 | 1384407
decoder.pkts_per_sec | Decode1 | 7689.232558
decoder.bytes | Decode1 | 1423315351
decoder.bytes_per_sec | Decode1 | 7967362.790698
decoder.mbit_per_sec | Decode1 | 63.738902

1384407 / 19 = 72863 pkt/s
1423315351 / 19 = 74811334 bytes/s
mbit/s value should be in the 550-570 range...

Above was in pcap file reading mode.

The values shown are the instataneous values and not for the entire period. For example before the counters api logs values to the file, it takes the accumulated local values, and the time over which these values were calcualted and calculates the accumu_local_value/time and then resets the global counter value to 0.

Attached is a patch which makes the values given by timebased counters more accurate.

Actions

#4

Updated by Victor Julien almost 15 years ago

When reading a pcap things seem to be off still. It processes 1.3M packets in 106sec, so an average 12k per second. Yet what I'm seeing is:

$ grep pkts_per_sec /var/log/suricata/stats.log
decoder.pkts_per_sec | Decode1 | 13445.545455
decoder.pkts_per_sec | Decode1 | 590.200000
decoder.pkts_per_sec | Decode1 | 630.909091
decoder.pkts_per_sec | Decode1 | 694.285714
decoder.pkts_per_sec | Decode1 | 642.545455
decoder.pkts_per_sec | Decode1 | 476.909091
decoder.pkts_per_sec | Decode1 | 724.555556
decoder.pkts_per_sec | Decode1 | 827.000000
decoder.pkts_per_sec | Decode1 | 758.571429
decoder.pkts_per_sec | Decode1 | 800.333333
decoder.pkts_per_sec | Decode1 | 885.285714
decoder.pkts_per_sec | Decode1 | 824.666667
decoder.pkts_per_sec | Decode1 | 580.166667
decoder.pkts_per_sec | Decode1 | inf
decoder.pkts_per_sec | Decode1 | inf
decoder.pkts_per_sec | Decode1 | 1273.486726

Actions

#5

Updated by Victor Julien almost 15 years ago

Due date changed from 01/31/2010 to 03/13/2010
Target version changed from 0.8.1 to 0.8.2

Actions

#6

Updated by Victor Julien over 14 years ago

Due date changed from 03/13/2010 to 04/30/2010
Target version changed from 0.8.2 to 0.9.0

Actions

#7

Updated by Victor Julien over 14 years ago

Target version changed from 0.9.0 to 0.9.1

Actions

#8

Updated by Victor Julien over 14 years ago

Target version changed from 0.9.1 to 0.9.2

Actions

#9

Updated by Victor Julien over 14 years ago

Due date changed from 04/30/2010 to 06/21/2010
Target version changed from 0.9.2 to 0.9.3
Estimated time changed from 2.50 h to 5.00 h

Actions

#10

Updated by Victor Julien over 14 years ago

Due date changed from 06/21/2010 to 06/28/2010
Target version changed from 0.9.3 to 1.0.0
Estimated time changed from 5.00 h to 8.00 h

Actions

#11

Updated by Victor Julien over 14 years ago

Target version changed from 1.0.0 to 1.0.1

I've disabled the counters that are affected.

Actions

#12

Updated by Victor Julien over 14 years ago

Status changed from New to Closed
% Done changed from 0 to 100

Counter redesign will be a separate task. Closing this bug.

Actions

Also available in: Atom PDF