[Bro-Dev] manager-child cpu utilization?

Robin Sommer robin at icir.org
Sun Sep 18 21:20:23 PDT 2011

On Fri, Sep 16, 2011 at 20:52 -0400, Seth wrote:

> I'm seeing what appears to be extremely high CPU utilization by the
> manager's child process in a rather large (23 worker?) cluster.  I
> believe the deserialization is being done by the child process

It's not actually, the child process just relays the raw data between
the remote side and the main process. The latter does the

Also, the logging does actually not use (most of) the normal
serialization framework. It has its own code for (un-)marshalling its
data, which is less complex. And I'm just realizing that once we have
merged in the threaded logging, we could actually even shift the
demarshalling to the threads I believe ..

On Sat, Sep 17, 2011 at 21:17 -0500, Martin wrote:

> Yep, this is definitely happening.  Our cluster's manager and its
> child, as well as the proxy and its child chew up about 20-25% CPU
> each, so that's almost a full CPU for the manager/child and
> proxy/child.

Note that the proxy doesn't see the logging data, just &synchronized
data passes through it. For the manager it's the opposite: it sees the
logs, but not &synchronized. Seth, didn't you say we actually don't
have much &synchronized at all anymore now?

The communication performance with the new scripts is something I'm
still planing to play with a bit more myself. Soon hopefully.

On Sat, Sep 17, 2011 at 23:37 -0500, Scott wrote:

> There is a select loop in RemoteSerializer.cc which may be a candidate
> to tune

Yes, this may indeed be something that could need a bit more tuning.
But generally, I don't really see the child process becoming a
bottleneck. High CPU there could also be just a sign of idle-looping a
bit too much.


Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the bro-dev mailing list