Project

General

Profile

Actions
Copy link

Support #5333

open

High cpu and high capture drops

Added by yuzhao yi almost 2 years ago. Updated 11 months ago.

Status:
Feedback
Priority:
Normal
Assignee:
yuzhao yi
Affected Versions:
6.0.4
Label:

Description

Hello, I have a puzzling problem!
I increased the number of Linux network cards to two, and configured Suricata to listen on both network cards.The flow has changed from 8g to about 15g.So the CPU becomes very high and the packet loss rate is also very high.
To rule out whether doubling traffic was causing the problem, I disabled one network card and let Suricata listen on only one.but the result is the same.cpu from 800-1500% to 3000-6000%, packet loss rate from<1% into>50%
My linux is centos7.6 72c128g.This happened once before, and no solution was found.Finally, the system was reinstalled and returned to normal

Files

Download all files
clipboard-202205071854-5rcml.png (10.5 KB) clipboard-202205071854-5rcml.png yuzhao yi, 05/07/2022 10:54 AM
clipboard-202205071858-iso9x.png (6.98 KB) clipboard-202205071858-iso9x.png yuzhao yi, 05/07/2022 10:58 AM
Actions
Copy link
 #1

Updated by yuzhao yi almost 2 years ago

  • File deleted (clipboard-202205071854-9bu2d.png)
Actions
Copy link
 #3

Updated by Victor Julien over 1 year ago

  • Tracker changed from Bug to Support
  • Assignee deleted (OISF Dev)
  • Priority changed from High to Normal
  • Target version deleted (TBD)

No idea what might cause such behavior.

Actions
Copy link
 #4

Updated by Philippe Antoine 11 months ago

  • Status changed from New to Feedback
  • Assignee set to yuzhao yi

Are you able to share some pcaps ?
What is the traffic on both cards ? (same subnetworks or different)
Can you share some profiling data ? (running tools like perf)

Actions
Copy link

Also available in: Atom PDF