[Bro] Debugging high-cpu on a single worker

[Dave Crawford]

> I'd guess it is one of two things:
> 
> The pin cpu setting that is pinning that worker to the same cpu that is being used for things like interrupts
> 
> The fact that it is the first worker on netmap may mean it receives all of a certain kind of traffic that can't otherwise be load balanced to the other workers.
> 
> What pin_cpus setting are you using and what does /proc/interrupts contain?
> 
> -- 
> - Justin Azoff
> 

You nailed it, I missed the IRQ triage and that NIC is pinned to the first CPU in its numa node, which matches with the first one Bro is pinned to.

So now the dilemma is that hardware only has 10 cores per CPU. So either I reduce the number of Bro workers to 9, and leave a core dedicated to NIC interrupts, or I pin the NIC to a core on the other CPU and incur a latency hit due to it being on a different numa node.

-Dave