Project

General

Custom queries

Profile

Actions

Optimization #7371

open

Task #5682: tracking: smb performance issues

Optimization #5672: smb: avoid unbounded hash maps

smb: events/counters for caches getting full

Added by Victor Julien about 2 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

When LruCache was introduced in the smb state, it introduced a mechanism to automatically evict the oldest entries. However, there is currently no way to observe this.

In some follow up I would like to add events and counters. Events aren't hard, I think. Though they would be along the lines of the most current addition evicted the oldest entry in the hash. Counters would give some insight into how common this is.

https://github.com/OISF/suricata/pull/12087#issuecomment-2460595294

Goal here is to add:
- a per hashmap counter to indicate when this happens
- app events for smb

No data to display

Actions

Also available in: Atom PDF