[Zeek] Workers occasionally using 102% CPU
Justin Azoff
justin at corelight.com
Mon Feb 24 08:16:30 PST 2020
Ah, sorry. The profiling confirms it's spending most of its time in
iosource::Manager::FindSoonest. As you noticed this code is completely
gone in the next version of zeek, from the NEWS file:
- Replace old ``select``-based IO loop with a new architecture that doesn't
spin checking for active IO sources. The new architecture now waits for
the
the sources to actively notify it when activity occurs and only processes
data once it's ready. This helps heavily reduce the CPU usage on idle
network connections.
I'm not sure if what you are seeing is a bug, or just an instance of the
older select loop not performing well. Since you said it seems to be
working fine otherwise and not dropping packets, I'm leaning towards just a
performance issue.
The new IO loop should perform much better, especially on lower utilized
links.
On Sat, Feb 22, 2020 at 10:20 AM Pete Nelson <petiepooo at gmail.com> wrote:
> Perf output mailed to you, Justin. I'm checking to see if other
> SecurityOnion users are seeing this, but haven't heard anything yet.
> The good news is that it doesn't break things, as it just consumes
> more CPU than usual.
>
> I appreciate you taking a look at this. Please let me know if you
> need anything else.
> --
> Pete
>
--
Justin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20200224/a2e0bc8d/attachment.html
More information about the Zeek
mailing list