[Bro-Dev] Performance Issues after the fe7e1ee commit?

Jon Siwek jsiwek at corelight.com
Tue Jun 12 12:16:22 PDT 2018


On Mon, Jun 11, 2018 at 6:30 PM Robin Sommer <robin at icir.org> wrote:

> Confirmed that I'm still seeing that difference even when using the
> options to turn the stores. Tried it on two different Fedora 28
> systems, with similar results.

I had previously tried on a Fedora 28 VM w/ 4 CPUs and didn't
reproduce it, but trying again on a system with 32 CPUs, I can
reproduce your results.  This has lead to the fix/workaround at [1],
now in master, which should bring things back to baseline when not
using data stores and more sane timings when using them.

General changes/improvements in CAF itself may be warranted here
because I can recreate the same performance overhead if I artificially
remove all broker functionality from Bro, but then simply create and
never use a caf::actor_system via the default configuration.

- Jon

[1] https://github.com/bro/bro/commit/c9fe9a943c4d78b18ffbae13c562b93349a5f951


More information about the bro-dev mailing list