Feature #9151
opendetect: Add option to disable tag tracking
Description
I'm seeing lock contention in HostLookupHostFromHash called from TagHandlePacket (with host.hash-size set to many times the default). I don't have any tagged packet logging enabled, so I get no benefit from tracking tags.
Would you consider a setting that disables tag tracking? The simplest version would be a detect.tag-tracking boolean that defaults to yes. Setting it to no would override eve tagged-packets and pcap-log conditional: tag.
If you're open to this, I could implement it.
VJ Updated by Victor Julien 24 days ago
IIRC tags can only be set by rules, so we could also auto-detect that no tags are in use and skip the check? Possibly a per detect engine flag of sorts? Guess that could leave edge cases around reloads adding/removing tags. An other way we've dealt with cases like this in the past is a global atomic that counts tags in use, if it is 0, skip the lookup. The read is cheap, but if there are many tag operations the counter could be expensive.
WB Updated by Will B 24 days ago
There is a global counter of active host/session tags called num_tags. If num_tags == 0, then TagHandlePacket returns early, and there's no problem. But in my case, I have (third party) tag rules that are getting hit, so num_tags > 0, and the "rules use tags" flag you suggested would also be set.
When num_tags > 0, every packet does the source and destination host lookups. This seems wasteful because, in my configuration, tags don't affect Suricata's output. A fix for me would be either the configuration setting I proposed, or perhaps auto-detection based on whether tags can change the output (i.e. whether "tagged-packets" or "pcap-log conditional: tag" are configured).