[Bro] CPU usage with no traffic on Bro 2.5 with AF_PACKET
zeolla at gmail.com
Sat Dec 17 09:16:22 PST 2016
I have a fork of 2.5 that may help. It's intended to minimize CPU load on
sensors that see low volume/sensor-local traffic. Check out the most
recent commits, shout out to Justin for the basis of the tweaks.
On Sat, Dec 17, 2016, 12:05 Ed Sealing <ed.sealing at sealingtech.org> wrote:
> I'm seeing ~6% CPU utilization on workers, with no traffic. Is that
> expected? Is there any way to minimize the CPU load?
> Using AF_PACKET plugin. The cores are isolated using "isolcpus", so
> nothing else should be running on them. Workers are pinned to the CPUs in
> Bro mailing list
> bro at bro-ids.org
Sent from my mobile device
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro