<div dir="ltr">Ah, sorry. The profiling confirms it's spending most of its time in iosource::Manager::FindSoonest. As you noticed this code is completely gone in the next version of zeek, from the NEWS file:<br><br>- Replace old ``select``-based IO loop with a new architecture that doesn't<br> spin checking for active IO sources. The new architecture now waits for the<br> the sources to actively notify it when activity occurs and only processes<br> data once it's ready. This helps heavily reduce the CPU usage on idle<br> network connections.<div><br></div><div>I'm not sure if what you are seeing is a bug, or just an instance of the older select loop not performing well. Since you said it seems to be working fine otherwise and not dropping packets, I'm leaning towards just a performance issue.</div><div><br></div><div>The new IO loop should perform much better, especially on lower utilized links.</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Feb 22, 2020 at 10:20 AM Pete Nelson <<a href="mailto:petiepooo@gmail.com">petiepooo@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Perf output mailed to you, Justin. I'm checking to see if other<br>
SecurityOnion users are seeing this, but haven't heard anything yet.<br>
The good news is that it doesn't break things, as it just consumes<br>
more CPU than usual.<br>
<br>
I appreciate you taking a look at this. Please let me know if you<br>
need anything else.<br>
--<br>
Pete<br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr">Justin</div></div>