Feature #9422
openSupport multi-threaded rule load
Description
Currently I understand Suricata's rule loading is single-threaded. Long config load times becomes a bottleneck for us with very large or complex rulesets, so it would help if Suricata supported splitting that work over multiple threads. It would be especially useful to support YAML configuration similar to management-cpu-set or worker-cpu-set so that the CPUs allocated for rule loading were configurable.
VJ Updated by Victor Julien 2 days ago
- Related to Feature #9409: detect: compile per-SGH MPM (Hyperscan) databases in parallel during rule load/reload added
JL Updated by Jamie Lavigne 1 day ago
Adding a bit more context: in our deployment every Suricata needs to load rulesets, but we also have dedicated fleets that do only ruleset pre-validation before those rulesets make it to the hosts that handle traffic. Configurable CPU sets would be especially useful for us so that we could configure maximum parallelism on the dedicated ruleset validation hosts, which don't need to handle packets at all.