[Zeek] Workers occasionally using 102% CPU

[Pete Nelson]

On Fri, Feb 21, 2020 at 12:32 AM Justin Azoff <justin at corelight.com> wrote:
>
> Oh.. you can use -p with perf and give it a pid.  strace is really not helpful at all for this sort of thing.

Ah, thanks.  I'm not familiar with perf, so had to research some.
Here's a sample of running perf-top against it for a bit:

Samples: 2K of event 'cycles:ppp', Event count (approx.): 23397706264
  Children      Self  Shared Object                  Symbol
+   36.85%     0.72%  libc-2.23.so                   [.] __select
+   34.78%     1.18%  [kernel]                       [k] do_syscall_64
+   34.53%     0.83%  [kernel]                       [k]
entry_SYSCALL_64_after_hwframe
+   32.88%     0.56%  [kernel]                       [k] sys_select
+   29.65%     1.15%  [kernel]                       [k] core_sys_select
+   20.18%     9.99%  [kernel]                       [k] do_select
+   10.12%     0.00%  [unknown]                      [k] 0x00007fe5752e0b20
+    9.14%     8.91%  libjemalloc.so.1               [.] free
+    7.60%     7.43%  libjemalloc.so.1               [.] malloc
+    7.05%     6.86%  zeek                           [.]
iosource::Manager::FindSoonest
+    5.67%     1.20%  [kernel]                       [k] __fdget
+    5.42%     5.42%  zeek                           [.]
std::_Rb_tree<int, int, std::_Identity<int>, std::less<int>,
std::allocator<int> >::_M_insert_unique<in
+    4.44%     0.93%  [kernel]                       [k] __fget_light
+    4.08%     3.94%  [kernel]                       [k] __fget

I also captured call-graph data as you requested earlier, but I don't
know what I'm looking at... how should I get that to you?  Direct
email, or attach to reply and let the list manager strip and provide a
link?  It's only 350k once gzipped.
--
Pete