[Bro-Dev] Performance Issues after the fe7e1ee commit?

[Jon Siwek]

On Wed, Jun 6, 2018 at 12:01 PM McMullan, Tim <Tim.McMullan at sig.com> wrote:

> Is the Bro development team still optimizing the Broker/Actor framework?

Yes, in the sense that optimizations will be done according to
feedback.  No, in the sense that there was no one actively looking
into it at the moment you asked.

> It might be helpful to have a way to disable Broker for those of us who haven’t migrated to it yet.

That's unlikely at this point as scripts have been completely ported
to Broker now and usages of the old communication system completely
removed from them.  No simple switch to it back, so your feedback is
especially important/helpful.

> #  ~1GB file time (old)
>
> $ time /hostname/bro-devel/bin/bro -r 20180606-1049-prodfilers-truncated_00000_20180606104904.pcap  master.bro
>
>
>
> real    0m2.294s
>
> user    0m1.862s
>
> sys     0m0.385s
>
>
>
> #  ~1GB file time  (new)
>
> $ time /hostname/bro-devel/bin/bro -r 20180606-1049-prodfilers-truncated_00000_20180606104904.pcap master.bro
>
>
>
> real    1m11.458s
>
> user    0m58.933s
>
> sys     1m34.074s

Try pulling in the change I just did at [1], which was a big part of
the problem in my own test:

# 2.5.3
$ time bro -r 2009-M57-day11-18.trace

real 0m16.187s
user 0m16.312s
sys 0m1.865s

# master before [1]
$ time bro -r ../testing/external/bro-testing/Traces/2009-M57-day11-18.trace

real 1m31.434s
user 1m44.925s
sys 1m4.947s

# master after [1]
$ time bro -r 2009-M57-day11-18.trace

real 0m24.595s
user 0m25.574s
sys 0m5.816s

- Jon

[1] https://github.com/bro/bro/commit/9822fc252d5e92208704df4a388ea31989869499