Bug #50

time based stats are not calculated correctly

Added by Victor Julien over 4 years ago. Updated over 3 years ago.

Status:ClosedStart date:01/08/2010
Priority:NormalDue date:06/28/2010
Assignee:Anoop Saldanha% Done:

100%

Category:-Estimated time:8.00 hours
Target version:1.0.1

Description

This is after a runtime of 19 seconds:

decoder.pkts | Decode1 | 1384407
decoder.pkts_per_sec | Decode1 | 7689.232558
decoder.bytes | Decode1 | 1423315351
decoder.bytes_per_sec | Decode1 | 7967362.790698
decoder.mbit_per_sec | Decode1 | 63.738902

1384407 / 19 = 72863 pkt/s
1423315351 / 19 = 74811334 bytes/s
mbit/s value should be in the 550-570 range...

Above was in pcap file reading mode.

0001-Fix-for-bug-50.-Make-timebased-counters-more-accura.patch Magnifier (9.19 KB) Anoop Saldanha, 02/18/2010 02:19 PM

History

#1 Updated by Victor Julien over 4 years ago

  • Target version set to 0.8.1

#2 Updated by Victor Julien about 4 years ago

  • Due date set to 01/31/2010

#3 Updated by Anoop Saldanha about 4 years ago

Victor Julien wrote:

This is after a runtime of 19 seconds:

decoder.pkts | Decode1 | 1384407
decoder.pkts_per_sec | Decode1 | 7689.232558
decoder.bytes | Decode1 | 1423315351
decoder.bytes_per_sec | Decode1 | 7967362.790698
decoder.mbit_per_sec | Decode1 | 63.738902

1384407 / 19 = 72863 pkt/s
1423315351 / 19 = 74811334 bytes/s
mbit/s value should be in the 550-570 range...

Above was in pcap file reading mode.

The values shown are the instataneous values and not for the entire period. For example before the counters api logs values to the file, it takes the accumulated local values, and the time over which these values were calcualted and calculates the accumu_local_value/time and then resets the global counter value to 0.

Attached is a patch which makes the values given by timebased counters more accurate.

#4 Updated by Victor Julien about 4 years ago

When reading a pcap things seem to be off still. It processes 1.3M packets in 106sec, so an average 12k per second. Yet what I'm seeing is:

$ grep pkts_per_sec /var/log/suricata/stats.log
decoder.pkts_per_sec | Decode1 | 13445.545455
decoder.pkts_per_sec | Decode1 | 590.200000
decoder.pkts_per_sec | Decode1 | 630.909091
decoder.pkts_per_sec | Decode1 | 694.285714
decoder.pkts_per_sec | Decode1 | 642.545455
decoder.pkts_per_sec | Decode1 | 476.909091
decoder.pkts_per_sec | Decode1 | 724.555556
decoder.pkts_per_sec | Decode1 | 827.000000
decoder.pkts_per_sec | Decode1 | 758.571429
decoder.pkts_per_sec | Decode1 | 800.333333
decoder.pkts_per_sec | Decode1 | 885.285714
decoder.pkts_per_sec | Decode1 | 824.666667
decoder.pkts_per_sec | Decode1 | 580.166667
decoder.pkts_per_sec | Decode1 | inf
decoder.pkts_per_sec | Decode1 | inf
decoder.pkts_per_sec | Decode1 | 1273.486726

#5 Updated by Victor Julien about 4 years ago

  • Due date changed from 01/31/2010 to 03/13/2010
  • Target version changed from 0.8.1 to 0.8.2

#6 Updated by Victor Julien about 4 years ago

  • Due date changed from 03/13/2010 to 04/30/2010
  • Target version changed from 0.8.2 to 0.9.0

#7 Updated by Victor Julien almost 4 years ago

  • Target version changed from 0.9.0 to 0.9.1

#8 Updated by Victor Julien almost 4 years ago

  • Target version changed from 0.9.1 to 0.9.2

#9 Updated by Victor Julien almost 4 years ago

  • Due date changed from 04/30/2010 to 06/21/2010
  • Target version changed from 0.9.2 to 0.9.3
  • Estimated time changed from 2.50 to 5.00

#10 Updated by Victor Julien almost 4 years ago

  • Due date changed from 06/21/2010 to 06/28/2010
  • Target version changed from 0.9.3 to 1.0.0
  • Estimated time changed from 5.00 to 8.00

#11 Updated by Victor Julien almost 4 years ago

  • Target version changed from 1.0.0 to 1.0.1

I've disabled the counters that are affected.

#12 Updated by Victor Julien over 3 years ago

  • Status changed from New to Closed
  • % Done changed from 0 to 100

Counter redesign will be a separate task. Closing this bug.

Also available in: Atom PDF