[Zeek] Performance hit with long lived flows
jsiwek at corelight.com
Fri Apr 10 10:27:03 PDT 2020
On Fri, Apr 10, 2020 at 12:07 AM Nabil Memon <nabilmemon.ec at gmail.com> wrote:
> I haven't explore if schedule routines works in the same main thread??
All script code is currently executed on the main thread.
> If yes, then obviously, this can hold bro's main packet processing thread and we may have a serious damage going through a big list of such table entries.
But I also thought of scanning in some batches,
Right, there's potential for scripts that do a lot of work at one time
to interfere w/ packet processing and batching the work across time is
a possible solution. Generalized coroutine support might also make it
a bit easier to structure such batch-and-yield logic, but don't think
there's near-term plans to add that feature.
More information about the Zeek