diff --git a/CHANGES b/CHANGES index 5019d3c305..adb24b8ed4 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,9 @@ +2.6-276 | 2019-05-08 09:03:27 -0700 + + * Force the Broker IOSource to idle periodically, preventing packet + IOSource starvation. (Jon Siwek, Corelight). + 2.6-274 | 2019-05-08 08:58:25 -0700 * GH-353: Add `//i` case-insensitive signature syntax (Jon Siwek, Corelight) diff --git a/VERSION b/VERSION index 6b87228960..5a9089c29d 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.6-274 +2.6-276 diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc index 959ef6cb9d..ebde5229d3 100644 --- a/src/broker/Manager.cc +++ b/src/broker/Manager.cc @@ -140,6 +140,7 @@ Manager::Manager(bool arg_reading_pcaps) reading_pcaps = arg_reading_pcaps; after_zeek_init = false; peer_count = 0; + times_processed_without_idle = 0; log_topic_func = nullptr; vector_of_data_type = nullptr; log_id_type = nullptr; @@ -944,7 +945,32 @@ void Manager::Process() } } - SetIdle(! had_input); + if ( had_input ) + { + ++times_processed_without_idle; + + // The max number of Process calls allowed to happen in a row without + // idling is chosen a bit arbitrarily, except 12 is around half of the + // SELECT_FREQUENCY (25). + // + // But probably the general idea should be for it to have some relation + // to the SELECT_FREQUENCY: less than it so other busy IOSources can + // fit several Process loops in before the next poll event (e.g. the + // select() call ), but still large enough such that we don't have to + // wait long before the next poll ourselves after being forced to idle. + if ( times_processed_without_idle > 12 ) + { + times_processed_without_idle = 0; + SetIdle(true); + } + else + SetIdle(false); + } + else + { + times_processed_without_idle = 0; + SetIdle(true); + } } diff --git a/src/broker/Manager.h b/src/broker/Manager.h index 6c1040f989..901cd4d06c 100644 --- a/src/broker/Manager.h +++ b/src/broker/Manager.h @@ -383,6 +383,7 @@ private: bool reading_pcaps; bool after_zeek_init; int peer_count; + int times_processed_without_idle; Func* log_topic_func; VectorType* vector_of_data_type;