[Bro-Dev] Bro 2.6-beta plans
Azoff, Justin S
jazoff at illinois.edu
Fri Sep 7 13:41:16 PDT 2018
> On Sep 6, 2018, at 7:40 PM, Jon Siwek <jsiwek at corelight.com> wrote:
> On Thu, Sep 6, 2018 at 3:40 PM Azoff, Justin S <jazoff at illinois.edu> wrote:
>> 8842 broker::topic+broker::internal_command+ at u32.bro/known/certs/<$>/data/clone
> Thanks, there was an unintended forwarding loop in data store
> communication. It's fixed in master now, but I've also just reverted
> to generally disabling the forwarding mechanisms by default (any
> specific/advanced use-cases can always choose to selectively enable
> it, but the default cluster config doesn't need it for anything
> For anyone doing testing, please pull the latest change from master
> and give feedback on that version.
> - Jon
Latest master works much better.
One thing I'm still seeing when I switch from an old version to latest master is that huge spike
in Content switches/interrupts and cpu spent in the kernel.
On one test worker box (that is receiving a full 10G and a bit overloaded)
before: context switches 200k/sec, interrupts 150k/sec
after: context switches 1mil/sec, interrupts 700k/sec
Before, cpu maxed out but spending 60% in user and 30% in system
After, cpu maxed out but spending 12% in user and 80% in system
On the manager side, cpu went up a little, but not by much.
I tried redef Broker::max_threads=2; but that didn't make much of a difference.
More information about the bro-dev