[Bro-Dev] #949: High CPU from polling loop on low traffic links

[Bro Tracker]

#949: High CPU from polling loop on low traffic links
--------------------------+------------------------
  Reporter:  liamrandall  |      Owner:
      Type:  Problem      |     Status:  new
  Priority:  Low          |  Milestone:  Bro2.2
 Component:  Bro          |    Version:  git/master
Resolution:               |   Keywords:
--------------------------+------------------------

Comment (by seth):

 > This machine is already running an IDS...Bro would be complementing
 this.
 > That said, I can't have Bro taking up 50% CPU with no traffic running.
 My
 > perception (expectation?) is that high traffic = high cpu, low traffic =
 > low cpu...though that my not be accurate or reasonable.  Thanks for all
 > your work on this Seth.

 Once traffic starts flowing through the box, Bro's CPU load will start to
 drop (oddly enough) until eventually it starts to go back up again if the
 traffic load is high enough.

 Bro needs to take care of a lot of housekeeping tasks and we keep a fairly
 tight loop to make sure that everything is taken care of with low latency.
 We are drawing up plans for some rework to our communication code (which
 contributes to the tight loop) and it may take care of some of the load
 problem.

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/949#comment:5>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker