Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

iosource: Make poll intervals configurable

Browse source 
This probably should not be changed by users, but it's useful for
testing and experimentation rather than needing to recompile.

Processing 100 packets without checking an FD based IO source can
actually mean that FD based sources are never checked during a read
of a very small pcap...
This commit is contained in:
Arne Welzel 2023-03-17 21:20:52 +01:00
parent 5f1a85803a
commit 46c432dc8b
4 changed files with 35 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

29
scripts/base/init-bare.zeek
View file

@ -5581,6 +5581,35 @@ const digest_salt = "Please change this value." &redef;
## :zeek:see:`find_all_ordered` BIFs.
const max_find_all_string_length: int = 10000 &redef;
## How many rounds to go without checking IO sources with file descriptors
## for readiness by default. This is used when reading from traces.
##
## Very roughly, when reading from a pcap, setting this to 100 results in
## 100 packets being processed without checking FD based IO sources.
##
## .. note:: This should not be changed outside of development or when
## debugging problems with the main-loop, or developing features with
## tight main-loop interaction.
##
## .. zeek:see:: io_poll_interval_live
const io_poll_interval_default = 100 &redef;
## How often to check IO sources with file descriptors for readiness when
## monitoring with a live packet source.
##
## The poll interval gets defaulted to 100 which is good for cases like reading
## from pcap files and when there isn't a packet source, but is a little too
## infrequent for live sources (especially fast live sources). Set it down a
## little bit for those sources.
##
## .. note:: This should not be changed outside of development or when
## debugging problems with the main-loop, or developing features with
## tight main-loop interaction.
##
## .. zeek:see:: io_poll_interval_default
const io_poll_interval_live = 10 &redef;
global done_with_network = F;
event net_done(t: time)
{ done_with_network = T; }

3
src/const.bif
View file

@ -11,6 +11,9 @@ const exit_only_after_terminate: bool;
const digest_salt: string;
const max_analyzer_violations: count;
const io_poll_interval_default: count;
const io_poll_interval_live: count;
const FTP::max_command_length: count;
const NFS3::return_data: bool;

7
src/iosource/Manager.cc
View file

@ -105,6 +105,7 @@ Manager::~Manager()
void Manager::InitPostScript()
{
wakeup = new WakeupHandler();
poll_interval = BifConst::io_poll_interval_default;
}
void Manager::RemoveAll()
@ -401,12 +402,8 @@ void Manager::Register(PktSrc* src)
{
pkt_src = src;
// The poll interval gets defaulted to 100 which is good for cases like reading
// from pcap files and when there isn't a packet source, but is a little too
// infrequent for live sources (especially fast live sources). Set it down a
// little bit for those sources.
if ( src->IsLive() )
poll_interval = 10;
poll_interval = BifConst::io_poll_interval_live;
else if ( run_state::pseudo_realtime )
poll_interval = 1;

2
src/iosource/Manager.h
View file

@ -216,7 +216,7 @@ private:
int zero_timeout_count = 0;
WakeupHandler* wakeup = nullptr;
int poll_counter = 0;
int poll_interval = 100;
int poll_interval = 0; // Set in InitPostScript() based on const value.
int event_queue = -1;
std::map<int, IOSource*> fd_map;