[Bro] Debugging high-cpu on a single worker

[Azoff, Justin S]

> On Feb 23, 2017, at 12:47 PM, Dave Crawford <bro at pingtrip.com> wrote:
> 
> I’m seeing a repeatable issue where the first worker of ten always has a higher CPU usage.
> 
>  11  3014 bro        20   0 2078M 1250M  502M R 97.4  1.0 18h34:48 /opt/bro/bin/bro -i netmap::bro}0 -U .status -p broctl -p broctl-live -p

I'd guess it is one of two things:

The pin cpu setting that is pinning that worker to the same cpu that is being used for things like interrupts

The fact that it is the first worker on netmap may mean it receives all of a certain kind of traffic that can't otherwise be load balanced to the other workers.

What pin_cpus setting are you using and what does /proc/interrupts contain?

-- 
- Justin Azoff