eve: Use threaded output by default
Change the default configuration setting of
eve.jsonfile but it also imposes the following change:
eve.jsonwill no longer be written to. Instead, multiple files name
eve.N.jsonwill be created (one for each Suricata thread that adds entries to the EVE log)
This requires upstream handling of the EVE log to be aware that the EVE log contents are spread among the collection of
eve.N.json files. Workflow processing must be cognizant of this. Individual log entries in each file continue to be timestamped so the entries could be time-stitched into a singular storage entity.
Updated by Andreas Herz about 1 year ago
We should also add the performance impact to the docs, at the explanation for the keyword but also the performance guide.
I was able to see the positive impact on a traffic test with 34-35Gbit/s and threaded performed much better. So could help drop rates in scenarios where a user has high volume of output and wants to write to disk