[Zeek] First attempt to upgrade to 3: Multiple interfaces
Justin Azoff
justin at corelight.com
Tue Mar 3 18:50:05 PST 2020
On Tue, Mar 3, 2020 at 9:39 PM Michał Purzyński <michalpurzynski1 at gmail.com>
wrote:
> From what you’re describing, you’re running Zeek on a resource constraints
> device.
>
> You might want to actually use the newest version - not sure where Justin
> fixes for the packet processing loop went in, but they should help a lot.
>
Oh hah, I don't need any credit for all of that work. I had an old patch
against 2.4/5/6 that would relax the polling loop interval so it wouldn't
eat up a lot of cpu on smaller devices, but it wasn't a fix. Tim
completely rewrote the IO loop so now zeek on a raspberry pi should use 0%
cpu when there's no traffic.
--
Justin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20200303/4d139aeb/attachment.html
More information about the Zeek
mailing list