PktSrc: Introduce Pcap::non_fd_timeout

Increasing this value 10x has lowered CPU usage on a Myricom based
deployment significantly with reportedly no adverse side-effects.

After reviewing the Zeek 3 IO loop, my hunch is that previously when
no packets were available, we'd sleep 20usec every loop iteration after
calling ->Process() on the packet source. With current master ->Process()
is called 10 times on a packet source before going to sleep just once
for 20 usec. Likely this explains the increased CPU usage reported.

It's probably too risky to increase the current value, so introduce
a const &redef value for advanced users to tweak it. A middle ground
might be to lower ``io_poll_interval_live`` to 5 and increase the new
``Pcap::non_fd_timeout`` setting to 100usec.

While this doesn't really fix #2296, we now have enough knobs for tweaking.

Closes #2296.
This commit is contained in:
Arne Welzel 2023-03-31 18:27:23 +02:00
parent 5718046b96
commit f00d6198af
3 changed files with 28 additions and 1 deletions

View file

@ -324,7 +324,7 @@ double PktSrc::GetNextTimeout()
if ( have_packet || had_packet )
return 0.0;
return 0.00002;
return BifConst::Pcap::non_fd_timeout;
}
// If there's an FD (offline or live) we want poll to do what it has to with it.

View file

@ -3,6 +3,7 @@ module Pcap;
const snaplen: count;
const bufsize: count;
const non_fd_timeout: interval;
%%{
#include <pcap.h>