[Bro] question about intel files

[philosnef]

We have 2 10 physical core systems with 20 logical cores for a total of 40. Bro has a capture loss of sub .5% across all workers, so it seems unlikely that the box is overloaded. The capture rate of the box, per pfring is about 3.5Gb/s. We reported memory issues in the past, but those were written off as not related to the memory leak recently patched in the 24 branch and the 25 branch. 

    On Tuesday, August 2, 2016 11:11 PM, Seth Hall <seth at icir.org> wrote:
 

 
> On Aug 2, 2016, at 10:33 AM, philosnef <philosnef at yahoo.com> wrote:
> 
> We are running pfring with lb_procs=20. We have 40 cores on the box. 

Is that 40 cores with hyper threading or without?  It's possible you're overwhelming the system if 20 of those cores are hyper threaded (this is definitely a guess though since there are so many things that could cause trouble).

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/


  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160803/0245ef93/attachment.html