[Bro-Dev] [JIRA] (BIT-1182) Input-framework thread spwan
Aashish Sharma (JIRA)
jira at bro-tracker.atlassian.net
Mon Apr 7 14:02:07 PDT 2014
Aashish Sharma created BIT-1182:
Summary: Input-framework thread spwan
Project: Bro Issue Tracker
Issue Type: Problem
Affects Versions: 2.2
Reporter: Aashish Sharma
Using the mode REREAD, I noticed that input-framework spawns a thread for every add/change/delete for the elements in the feed file.
this is a VERY desired feature and powerful capability and works quite well in general settings.
Since, all the changes in a file spawns a thread to process for: EVENT_NEW, EVENT_CHANGED, EVENT_REMOVED, If there are lets say 5000 Changes in the file, there would be 5000 threads spawned at the same time. this is still alright and system can handle load and processing is done in a few seconds.
However, if I include a when statement along with exec framework usage to execute an action in Input::EVENT_NEW, Input::EVENT_CHANGED or Input::EVENT_REMOVED - all threads spawned together freezes bro from processing any packets at all.
It would be nice if we can serialize this thread creation and spawn only a few at a time. This way we can spread out the increased load over next N mins instead of freezing bro to a standstill.
(As always, please let me know if you want code to be able to re-produce this issue).
This message was sent by Atlassian JIRA
More information about the bro-dev