[Bro-Dev] Impact of timers/scheduled events?

[Robin Sommer]

On Tue, Aug 30, 2011 at 10:19 -0400, you wrote:

> I'm not exactly sure of all the impacts of scheduling events.  Are
> there any known issues with scheduling very large numbers of them?

Generally, timers are quite efficient, note that there's already at
least one per connection internally. Never tried to create huge
numbers on the scripting layer but I would think it should work
reasonably well. I think more important than the sheer number is the
churn rate: if you reinstall zillions of timers every few seconds, it
gets expensive. Also, Bro limits the numbers of timers it expires at
once, so there could be a backlog accumulating if too many fire
simultaniously.

Standard disclaimer: I don't dare to make performance predictions
about Bro anymore without actually trying it. :)

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org