[Bro] Debugging high-cpu on a single worker
Azoff, Justin S
jazoff at illinois.edu
Thu Feb 23 10:37:09 PST 2017
> On Feb 23, 2017, at 12:47 PM, Dave Crawford <bro at pingtrip.com> wrote:
> I’m seeing a repeatable issue where the first worker of ten always has a higher CPU usage.
> 11 3014 bro 20 0 2078M 1250M 502M R 97.4 1.0 18h34:48 /opt/bro/bin/bro -i netmap::bro}0 -U .status -p broctl -p broctl-live -p
I'd guess it is one of two things:
The pin cpu setting that is pinning that worker to the same cpu that is being used for things like interrupts
The fact that it is the first worker on netmap may mean it receives all of a certain kind of traffic that can't otherwise be load balanced to the other workers.
What pin_cpus setting are you using and what does /proc/interrupts contain?
- Justin Azoff
More information about the Bro