mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
PktSrc: Introduce Pcap::non_fd_timeout
Increasing this value 10x has lowered CPU usage on a Myricom based deployment significantly with reportedly no adverse side-effects. After reviewing the Zeek 3 IO loop, my hunch is that previously when no packets were available, we'd sleep 20usec every loop iteration after calling ->Process() on the packet source. With current master ->Process() is called 10 times on a packet source before going to sleep just once for 20 usec. Likely this explains the increased CPU usage reported. It's probably too risky to increase the current value, so introduce a const &redef value for advanced users to tweak it. A middle ground might be to lower ``io_poll_interval_live`` to 5 and increase the new ``Pcap::non_fd_timeout`` setting to 100usec. While this doesn't really fix #2296, we now have enough knobs for tweaking. Closes #2296.
This commit is contained in:
parent
5718046b96
commit
f00d6198af
3 changed files with 28 additions and 1 deletions
|
@ -324,7 +324,7 @@ double PktSrc::GetNextTimeout()
|
|||
if ( have_packet || had_packet )
|
||||
return 0.0;
|
||||
|
||||
return 0.00002;
|
||||
return BifConst::Pcap::non_fd_timeout;
|
||||
}
|
||||
|
||||
// If there's an FD (offline or live) we want poll to do what it has to with it.
|
||||
|
|
|
@ -3,6 +3,7 @@ module Pcap;
|
|||
|
||||
const snaplen: count;
|
||||
const bufsize: count;
|
||||
const non_fd_timeout: interval;
|
||||
|
||||
%%{
|
||||
#include <pcap.h>
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue