Bug #1578
Updated by Victor Julien over 8 years ago
In autofp mode and with a multicore box it is possible the reload of rules get stuck between the two following log messages: @[23912] 16/10/2015 -- 15:44:53 - (detect-engine.c:593) <Notice> (DetectEngineReloadThreads) -- rule reload starting [23912] 16/10/2015 -- 15:44:58 - (detect-engine.c:747) <Notice> (DetectEngineReloadThreads) -- rule reload complete@ On a system with 8 cores, the auto mode of af-packet is starting 8 capture threads and this can cause some threads to get stuck in the DetectEngineReloadThreads function looping and waiting for threads to be ready: <pre> @while (!TmThreadsCheckFlag(tv, THV_RUNNING_DONE)) { usleep(100); }@ </pre> Or at line detect-engine.c:703 We should check the thread causing the issue and see how we can implement the timoeout as the delay to reload can be really long.