[Bro-Dev] Bro 2.6-beta plans

[Azoff, Justin S]

On Sep 5, 2018, at 6:35 PM, Jon Siwek <jsiwek at corelight.com<mailto:jsiwek at corelight.com>> wrote:

There's no significant code changes/features planned to get added to
the master branch from now until the 2.6-beta gets released (maybe in
about a week).  Until that happens, please help test the latest master
branch and provide any feedback about how it's working if you can.

- Jon

Hi again!

Just finished the migration to master across the board, and it's looking REALLY good.

No crashes, memory is stable, cpu is pretty good.  The only thing I noticed is the manager userspace CPU utilization on one cluster
jumped up a bit after the switch.

This graph shows the system and userspace utilization across an 8 physical node cluster.  All the lower lines are the system usage
and the higher lines are userspace.  The Y axis is cpu seconds per second, so 4 is full 4 cores worth of usage.

After the switchover:

* the worker userspace cpu utilization was unchanged
* the worker system cpu utilization increased a bit, but I believe that is due to more time spent in the myricom driver waiting for packets
* the manager system cpu utilization dropped a bunch
* the manager userspace cpu increased 1-3x

The manager box in this cluster only runs the manager and logger processes, no proxies.  It also has something like 20 idle cores,
so this isn't a problem at all, but could affect people who run a cluster-in-a-box.

[cid:3BF8BC03-721F-44E6-A052-6E1ADA454C02 at home]

I do seem to be seeing a bunch of reporter errors like

Reporter::ERROR string with embedded NUL: "\\x00\\x00\\x00\\x00OPTIONS"

but I'm not sure if that is a new thing.

—
Justin Azoff

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.icsi.berkeley.edu/pipermail/bro-dev/attachments/20180912/b09f9202/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: cluster 2.6 cpu.jpeg
Type: image/jpeg
Size: 23588 bytes
Desc: cluster 2.6 cpu.jpeg
Url : http://mailman.icsi.berkeley.edu/pipermail/bro-dev/attachments/20180912/b09f9202/attachment-0001.jpeg