OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • Archive »
  • 17.1 Legacy Series »
  • Suricata using only one core
« previous next »
  • Print
Pages: [1]

Author Topic: Suricata using only one core  (Read 9597 times)

ejprice

  • Newbie
  • *
  • Posts: 33
  • Karma: 6
    • View Profile
Suricata using only one core
« on: March 03, 2017, 04:55:36 am »
Forgive my newbieness but it appears to me that Suricata while being multithreaded is only using one core on my OPNSense box. I noticed this while doing multiple downloads of large files simultaneously.

I initially noticed it because I wanted to check the load on my new OPNSense firewall. After running 'top' from the shell I noticed one CPU running Suricata was pinned at 100% while the other was relatively idle. I then did some checking about Suricata to see if it was multithreaded or multiprocess. It claims to be multithreaded. I tried the downloads again, same behavior so I put 'top' into threads mode. Sure enough, multiple threads but the ones under load were running on the same core.

I don't believe this is the correct or expected behavior for a multithreaded application.

System in question is OPNSense 17.1.2 running on a x86_64 Core 2 Duo with 2GB ram and SSD drive.

Steps to reproduce:

1) Download multiple streams of "stuff" at a sufficiently high download speed

2) run top or something else to watch the load on the system. Press "H" to view all the threads under load running on one core (there were other Suricata threads but with little to no CPU time)

Can anyone else confirm this behavior?
Logged
"Computers allow people to make mistakes faster than anything else in history, with the possible exception of handguns and tequila."

KD93

  • Newbie
  • *
  • Posts: 1
  • Karma: 0
    • View Profile
Re: Suricata using only one core
« Reply #1 on: March 16, 2017, 08:36:55 am »
Same for me.
Suricata is running on one interface for me (em1) and shows the following threads when it's under high load:

PID USERNAME   PRI NICE   SIZE    RES STATE   C   TIME    WCPU COMMAND
33051 root       103    0   898M   475M CPU1    1   3:49 100.00% suricata{W#01-em1+}
33051 root       -92    0   898M   475M select  2   0:42  16.55% suricata{W#01-em1}
33051 root        20    0   898M   475M uwait   2   0:24   0.33% suricata{FM#01}
33051 root        20    0   898M   475M nanslp  1   0:18   0.16% suricata{suricata}

Logged

ejprice

  • Newbie
  • *
  • Posts: 33
  • Karma: 6
    • View Profile
Re: Suricata using only one core
« Reply #2 on: March 28, 2017, 05:07:04 pm »
Anyone else try testing this? It seems to be a very limiting factor on a SMP box.
Logged
"Computers allow people to make mistakes faster than anything else in history, with the possible exception of handguns and tequila."

tcmax

  • Newbie
  • *
  • Posts: 8
  • Karma: 1
    • View Profile
Re: Suricata using only one core
« Reply #3 on: March 28, 2017, 05:17:56 pm »
Me too on a APU2C4 with latest 17.1.3
Logged

sagem2004

  • Newbie
  • *
  • Posts: 38
  • Karma: 2
    • View Profile
Re: Suricata using only one core
« Reply #4 on: March 28, 2017, 05:39:33 pm »
Me too on a J1900 Router Qotom-Q190G4N  17.1.3
Logged

rgo

  • Newbie
  • *
  • Posts: 27
  • Karma: 1
    • View Profile
Re: Suricata using only one core
« Reply #5 on: March 28, 2017, 06:44:30 pm »
Same here on 3 different test installs of opnsense for 17.1.3.  Only using 1 core.
Logged

tcmax

  • Newbie
  • *
  • Posts: 8
  • Karma: 1
    • View Profile
Re: Suricata using only one core
« Reply #6 on: March 28, 2017, 06:54:21 pm »
Any chance to force suricata using more cores?
Logged

ejprice

  • Newbie
  • *
  • Posts: 33
  • Karma: 6
    • View Profile
Re: Suricata using only one core
« Reply #7 on: March 28, 2017, 08:06:10 pm »
I've tried changing some of the Suricata settings but so far no luck.
Logged
"Computers allow people to make mistakes faster than anything else in history, with the possible exception of handguns and tequila."

tcmax

  • Newbie
  • *
  • Posts: 8
  • Karma: 1
    • View Profile
Re: Suricata using only one core
« Reply #8 on: March 29, 2017, 05:09:30 pm »
Here ist a part from the boot logfile.
Maybe that´s the reason...?!

"Starting suricata.
29/3/2017 -- 16:57:19 - <Warning> - [ERRCODE: SC_WARN_FASTER_CAPTURE_AVAILABLE(275)] - faster capture option is available: NETMAP (--netmap=igb1). Use --pcap=igb1 to suppress this warning
29/3/2017 -- 16:57:19 - <Info> - Including configuration file installed_rules.yaml.
Starting CRON...done."
« Last Edit: March 29, 2017, 05:28:39 pm by tcmax »
Logged

ejprice

  • Newbie
  • *
  • Posts: 33
  • Karma: 6
    • View Profile
Re: Suricata using only one core
« Reply #9 on: March 29, 2017, 10:43:15 pm »
Hmm. My command line shows I'm using netmap. I think that is the out-of-the-box setting.

/usr/local/bin/suricata -D --netmap --pidfile /var/run/suricata.pid {...}
Logged
"Computers allow people to make mistakes faster than anything else in history, with the possible exception of handguns and tequila."

johan

  • Newbie
  • *
  • Posts: 2
  • Karma: 0
    • View Profile
Re: Suricata using only one core
« Reply #10 on: April 27, 2017, 09:42:05 pm »
I seem to get Suricata to distribute load more evenly among cores by switching the runmode from "workers" to "autofp".

The work that Suricata assign cores is quite different with the runmodes, described shortly here:
http://suricata.readthedocs.io/en/latest/configuration/suricata-yaml.html#ips-mode

What I did was change

runmode: workers

to

runmode: autofp

in /usr/local/etc/suricata/suricata.yaml and restart suricata using the gui.
Logged

tcmax

  • Newbie
  • *
  • Posts: 8
  • Karma: 1
    • View Profile
Re: Suricata using only one core
« Reply #11 on: April 29, 2017, 11:06:56 am »
when i change this parameter, my throughpout drops from 7.6 mb/sec to 5.4 mb/sec :-(
HW: APU2C4
Logged

  • Print
Pages: [1]
« previous next »
  • OPNsense Forum »
  • Archive »
  • 17.1 Legacy Series »
  • Suricata using only one core
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2