Feature #5461
openeve: Use threaded output by default
Description
Change the default configuration setting of eve-log.threaded to on (enabled).
eve.json file but it also imposes the following change:
eve.jsonwill no longer be written to. Instead, multiple files nameeve.N.jsonwill be created (one for each Suricata thread that adds entries to the EVE log)
This requires upstream handling of the EVE log to be aware that the EVE log contents are spread among the collection of eve.N.json files. Workflow processing must be cognizant of this. Individual log entries in each file continue to be timestamped so the entries could be time-stitched into a singular storage entity.
VJ Updated by Victor Julien over 4 years ago
- Subject changed from Use threaded output by default to eve: Use threaded output by default
AH Updated by Andreas Herz over 4 years ago
We should also add the performance impact to the docs, at the explanation for the keyword but also the performance guide.
I was able to see the positive impact on a traffic test with 34-35Gbit/s and threaded performed much better. So could help drop rates in scenarios where a user has high volume of output and wants to write to disk
JL Updated by Jeff Lucovsky 9 days ago
Jason Ish wrote in #note-3:
I wonder if ever setting this to the default is a good idea. I think it might break a lot of tools and possibly be confusing.
Idea: A documentation section on the must-do config tweaks one should consider before going to production?
That's a good idea. We don't have a section like this in our documentation -- correct?
JI Updated by Jason Ish 9 days ago
Jeff Lucovsky wrote in #note-4:
Jason Ish wrote in #note-3:
I wonder if ever setting this to the default is a good idea. I think it might break a lot of tools and possibly be confusing.
Idea: A documentation section on the must-do config tweaks one should consider before going to production?
That's a good idea. We don't have a section like this in our documentation -- correct?
No, we don't - I don't even have a good example, but I do know I've seen documentation for other projects that have such a thing; I just can't dig any up right now.