[Zeek] Workers occasionally using 102% CPU

Doug Burks doug.burks at gmail.com
Thu Mar 5 06:44:04 PST 2020


Good morning Jon,

I applied the relevant patch to the Zeek 3.0.2 tarball, compiled, and have
been running for the last 3 hours or so with the same pcap replay loop
described previously.  Zeek still seems to be averaging 10% to 20% CPU
usage, so the patch is looking good so far.

Would you recommend that we apply the patch to our Zeek 3.0.2 package OR
hold off on 3.0.2 and wait for 3.0.3 assuming it will be included there?

Thanks!

On Wed, Mar 4, 2020 at 11:48 PM Jon Siwek <jsiwek at corelight.com> wrote:

> On Wed, Mar 4, 2020 at 12:44 PM Doug Burks <doug.burks at gmail.com> wrote:
>
> > Just a quick note to confirm that I'm seeing much time spent in
> `threading::Manager::NextTimestamp` here as well.
>
> That didn't turn out to be directly related, but I did ultimately hunt
> down a race condition in Broker as explanation for it getting stuck at
> full CPU load.  This is the incoming patch:
>
>     https://github.com/zeek/broker/pull/97
>
> Thanks for the assists in tracking this down.  Any further help in
> verifying the patch would also be great.
>
> - Jon
>


-- 
Doug Burks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20200305/448be63e/attachment.html 


More information about the Zeek mailing list