[Zeek] Workers occasionally using 102% CPU

[Michał Purzyński]

Can we disable scripts and run Zeek with a minimalist configuration and see
if result changes?

The timestamp thing looks like a packet timestamp?

Do use you libpcap by chance?

On Wed, Mar 4, 2020 at 12:46 PM Doug Burks <doug.burks at gmail.com> wrote:

> On Wed, Mar 4, 2020 at 3:15 PM Doug Burks <doug.burks at gmail.com> wrote:
>
>> Hi Jon,
>>
>> Replies inline.
>>
>> On Wed, Mar 4, 2020 at 3:06 PM Jon Siwek <jsiwek at corelight.com> wrote:
>>
>>> On Wed, Mar 4, 2020 at 8:36 AM Doug Burks <doug.burks at gmail.com> wrote:
>>>
>>> > - I've been able to trigger this issue fairly consistently using
>>> VMware Workstation with the VM set to 4 processors (seems easier to
>>> duplicate when using processors rather than cores)
>>>
>>> Thanks, I've reproduced with a similar configuration.  First thing I
>>> notice is `perf top` showing much time spent in
>>> `threading::Manager::NextTimestamp`, so now off to try and understand
>>> how it can get into that state.
>>
>>
> Just a quick note to confirm that I'm seeing much time spent in
> `threading::Manager::NextTimestamp` here as well.
>
> --
> Doug Burks
> _______________________________________________
> Zeek mailing list
> zeek at zeek.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20200304/311834f7/attachment.html