Suricata » Suricata-Update

Source: https://github.com/jasonish/docker-suricata/issues/52
Reporter: Jonny5 (@j0nny55555)

suricata-update takes approximately eight minutes to process a ruleset with a
large number of rule modifications. The run uses eight available CPU cores but
appears to use only one core (about 20% total VM CPU utilization in Proxmox,
while Portainer reports 100% container CPU utilization). RAM is not
constrained.

This was observed with the Suricata 8.0.2 container, which uses Python 3.9.21.
The original request suggested testing Python 3.10 or 3.12 to see whether a
newer Python version would improve performance or resource utilization.

The update is run with --no-test --no-reload, so the reported time does not
include Suricata's rule test. The configuration has many enable, disable, and
modify expressions. A close approximation of the reporter's modify.conf is
available here:

https://github.com/j0nny55555/noiseless-suricata-update/blob/main/modify.conf

Representative command:

nice -n -15 suricata-update update \
  --config /etc/suricata/update.yaml \
  --suricata-conf /etc/suricata/suricata.yaml \
  --show-advanced \
  --output /etc/suricata/homelab \
  -v --no-test --no-reload

Please investigate whether rule modification processing can be optimized or
make better use of available CPU resources. Some regular expressions in the
modify configuration may be contributing to the runtime.