zeek/scripts/base
Arne Welzel f00d6198af PktSrc: Introduce Pcap::non_fd_timeout
Increasing this value 10x has lowered CPU usage on a Myricom based
deployment significantly with reportedly no adverse side-effects.

After reviewing the Zeek 3 IO loop, my hunch is that previously when
no packets were available, we'd sleep 20usec every loop iteration after
calling ->Process() on the packet source. With current master ->Process()
is called 10 times on a packet source before going to sleep just once
for 20 usec. Likely this explains the increased CPU usage reported.

It's probably too risky to increase the current value, so introduce
a const &redef value for advanced users to tweak it. A middle ground
might be to lower ``io_poll_interval_live`` to 5 and increase the new
``Pcap::non_fd_timeout`` setting to 100usec.

While this doesn't really fix #2296, we now have enough knobs for tweaking.

Closes #2296.
2023-03-31 18:48:08 +02:00
..
files Spelling fixes: scripts 2022-11-02 17:36:39 -04:00
frameworks Add pcap_file option to supervised nodes. 2023-03-21 16:18:02 +01:00
misc annotate base scripts with &is_used as needed 2022-05-26 17:39:17 -07:00
packet-protocols Use a default analyzer 2023-02-16 19:39:27 -07:00
protocols dns: Remove AD and CD flags from log 2023-03-16 10:09:27 +01:00
utils Treat private address space as site-local by default 2023-03-15 17:01:00 -07:00
init-bare.zeek PktSrc: Introduce Pcap::non_fd_timeout 2023-03-31 18:48:08 +02:00
init-default.zeek Provide infrastructure to migrate legacy analyzers to Spicy. 2023-02-01 11:33:48 +01:00
init-frameworks-and-bifs.zeek analyzer: Add analyzer.log for logging violations/confirmations 2023-01-09 18:11:49 +01:00
init-supervisor.zeek Establish a separate init script when using the supervisor 2021-07-08 13:12:53 -07:00