[Bro-Dev] [JIRA] (BIT-1408) Broker I/O loop issue

Jon Siwek (JIRA) jira at bro-tracker.atlassian.net
Wed Jun 3 06:43:01 PDT 2015

    [ https://bro-tracker.atlassian.net/browse/BIT-1408?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=20914#comment-20914 ] 

Jon Siwek commented on BIT-1408:

topic/jsiwek/bit-1408 has an idea for a fix.

* The changes to bro_broker::Manager I think make more sense in the context of how the IOSource API is claimed to work -- it's now always considered idle and relies only on select() to trigger processing.  The timestamp associated with the work to be processed is always the last time select() indicated readiness for the broker IOSource.

* Historically, the stdin file descriptor got added to all IOSource's fd_set before doing select() if the particular fd_set was empty.  I never really figured out why this was there, but for some reason it reduced cpu usage when reading live traffic and removing it caused poorer packet capture performance (IIRC, for at least one user that complained).  However, adding in stdin to bro_broker::Manager's fd_sets basically defeats the goal of the changes mentioned in the last bullet point, so I've just moved the "hack" into PktSrc, the IOSource where it seems to matter.  Ultimately, I think this is just a hack and needs to be completely removed, but I don't understand what the purpose of it was in the main I/O loop to begin with or what change needs to be done in its place to improve the cpu usage and capture performance.

* I haven't extensively tested the changes in this branch -- not that concerned about the Broker IOSource changes, but I know how easy it is to break stuff in the main I/O loop...

> Broker I/O loop issue
> ---------------------
>                 Key: BIT-1408
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1408
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: Broker
>            Reporter: Robin Sommer
>             Fix For: 2.4
>         Attachments: patch.txt
> This script from Johanna doesn't terminate:
> {code}
> redef exit_only_after_terminate = T;
> event terminate_me() {
>         print "terminating";
>         terminate();
> }
> event bro_init() {
>         BrokerComm::enable();
>         schedule 1sec { terminate_me() };
> }
> {code}
> It works once the {{enable()}} call is removed.
> Attached patch seems solve the problem, but it might not be quite the right fix, not sure yet.

This message was sent by Atlassian JIRA

More information about the bro-dev mailing list