[Bro-Dev] Bro 2.6-beta plans

Jon Siwek jsiwek at corelight.com
Fri Sep 7 15:58:50 PDT 2018


On Fri, Sep 7, 2018 at 3:41 PM Azoff, Justin S <jazoff at illinois.edu> wrote:

> One thing I'm still seeing when I switch from an old version to latest master is that huge spike
> in Content switches/interrupts and cpu spent in the kernel.

I just updated the default tuning parameters for CAF's scheduling
policy and exposed them all in Bro [1] and get within 10% of the
number of context switches that 2.5.5 had in a very simple test case.

Let me know how that goes for everyone.

[1] https://github.com/bro/bro/blob/4bd6da71864b4ab68b372954c6268a023d69e52b/scripts/base/frameworks/broker/main.bro#L64-L94


More information about the bro-dev mailing list