[Bro-Dev] Bro 2.6-beta plans

[Azoff, Justin S]

> On Sep 6, 2018, at 7:40 PM, Jon Siwek <jsiwek at corelight.com> wrote:
> 
> On Thu, Sep 6, 2018 at 3:40 PM Azoff, Justin S <jazoff at illinois.edu> wrote:
> 
>>   8842 broker::topic+broker::internal_command+ at u32.bro/known/certs/<$>/data/clone
> 
> Thanks, there was an unintended forwarding loop in data store
> communication.  It's fixed in master now, but I've also just reverted
> to generally disabling the forwarding mechanisms by default (any
> specific/advanced use-cases can always choose to selectively enable
> it, but the default cluster config doesn't need it for anything
> currently).
> 
> For anyone doing testing, please pull the latest change from master
> and give feedback on that version.
> 
> - Jon

Latest master works much better.

One thing I'm still seeing when I switch from an old version to latest master is that huge spike
in Content switches/interrupts and cpu spent in the kernel.

On one test worker box (that is receiving a full 10G and a bit overloaded)

before: context switches 200k/sec, interrupts 150k/sec
after: context switches 1mil/sec, interrupts 700k/sec

Before, cpu maxed out but spending 60% in user and 30% in system
After, cpu maxed out but spending 12% in user and 80% in system

On the manager side, cpu went up a little, but not by much.

I tried redef Broker::max_threads=2; but that didn't make much of a difference.

— 
Justin Azoff