zeek/scripts
Arne Welzel f00d6198af PktSrc: Introduce Pcap::non_fd_timeout
Increasing this value 10x has lowered CPU usage on a Myricom based
deployment significantly with reportedly no adverse side-effects.

After reviewing the Zeek 3 IO loop, my hunch is that previously when
no packets were available, we'd sleep 20usec every loop iteration after
calling ->Process() on the packet source. With current master ->Process()
is called 10 times on a packet source before going to sleep just once
for 20 usec. Likely this explains the increased CPU usage reported.

It's probably too risky to increase the current value, so introduce
a const &redef value for advanced users to tweak it. A middle ground
might be to lower ``io_poll_interval_live`` to 5 and increase the new
``Pcap::non_fd_timeout`` setting to 100usec.

While this doesn't really fix #2296, we now have enough knobs for tweaking.

Closes #2296.
2023-03-31 18:48:08 +02:00
..
base PktSrc: Introduce Pcap::non_fd_timeout 2023-03-31 18:48:08 +02:00
policy SSL/TLS CertificateRequest message: Address review feedback 2023-03-15 09:19:26 +01:00
site Deprecate misc/scan.zeek 2022-08-23 09:10:53 +02:00
zeekygen mqtt: Move from policy/ into base/ 2022-11-30 10:14:20 +01:00
CMakeLists.txt Add base/misc/installation.zeek, with Zeek installation directories 2022-05-23 14:16:59 -07:00
test-all-policy.zeek SSL/TLS: Parse CertificateRequest message 2023-03-09 09:12:29 +01:00