[Zeek] Workers occasionally using 102% CPU

[Jon Siwek]

On Tue, Feb 25, 2020 at 8:41 AM Pete Nelson <petiepooo at gmail.com> wrote:

> Does this make sense to you?  Trigger any memories of changes that
> went into 3.0 that might have altered behavior in that area?

These are some differences between 2.6 and 3.0 that come to mind as
possibly related:

* https://github.com/zeek/zeek/issues/346 and
https://github.com/zeek/zeek/pull/358
* https://github.com/zeek/broker/commit/0abe5277

Your descriptions makes me generally suspect the Broker flare_actor
code, either it being introduced in that later commit or just the
patch that was attempted to fix similar behavior to what you notice is
incomplete (and possibly wasn't an issue in 2.6 because underlying CAF
library was just different there, too).  And if there's still a bug
there, then I'd expect it would also break the 3.1.0 IO loop despite
it generally being re-written.

If you have more ideas to narrow it down or can pinpoint which pipe
isn't getting fully drained, that will be helpful.

- Jon