# Bro 2.5 CPU usage **URL:** \ **Category:** Zeek\ **Created:** [November 25, 2016, 4:45pm UTC](https://community.zeek.org/t/bro-2-5-cpu-usage/4511 "2016-11-25T16:45:09Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Dave\_Crawford](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@Dave\_Crawford](https://community.zeek.org/u/Dave_Crawford)\ **Post date:** [November 25, 2016, 4:45pm UTC](https://community.zeek.org/t/bro-2-5-cpu-usage/4511/1 "2016-11-25T16:45:09Z")
I finally had an opportunity to install a Bro 2.5 cluster in the lab for review and was surprised to see a higher CPU usage than 2.4 deployments. A clean install with (w/ PF\_RING) never drops below 25% CPU per worker at idle, meaning I’ve disabled the SPAN traffic and Bro stays at 25%. I then went as far as disabling every default script except for the following: @load misc/loaded-scripts @load tuning/defaults @load misc/capture-loss @load misc/profiling.bro @load misc/stats And the CPU remains at 25%. Has anyone experienced similar results with 2.5? -Dave ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [November 25, 2016, 4:59pm UTC](https://community.zeek.org/t/bro-2-5-cpu-usage/4511/2 "2016-11-25T16:59:39Z")
Bro doesn't do a great job of using low amounts of CPU at low data rates - it's more tweaked for a constant packet rate. I use the following patch at home (it applies on 2.4-2.5) which reduces cpu quite a bit when traffic rates are extremely low --- a/bro-2.4/src/iosource/Manager.cc +++ b/bro-2.4/src/iosource/Manager.cc @@ -137,7 +137,7 @@      // decrease CPU load. I guess that's because it allows      // the kernel's packet buffers to fill. - Robin      timeout.tv\_sec = 0; - timeout.tv\_usec = 20; // SELECT\_TIMEOUT; + timeout.tv\_usec = 2000; // SELECT\_TIMEOUT;      select(0, 0, 0, 0, &timeout);      } --- a/bro-2.4/src/Net.cc +++ b/bro-2.4/src/Net.cc @@ -359,7 +359,7 @@        if ( ! communication\_enabled )          usleep(100000);        else - usleep(1000); + usleep(10000);        // Flawfinder says about usleep:        // --- a/bro-2.4/src/threading/MsgThread.cc +++ b/bro-2.4/src/threading/MsgThread.cc @@ -234,7 +234,7 @@        }      if ( ! Killed() ) - usleep(1000); + usleep(10000);      }    signal\_val = old\_signal\_val; ---
**Author:** ![Dave\_Crawford](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@Dave\_Crawford](https://community.zeek.org/u/Dave_Crawford)\ **Post date:** [November 25, 2016, 5:02pm UTC](https://community.zeek.org/t/bro-2-5-cpu-usage/4511/3 "2016-11-25T17:02:02Z")
Thanks Justin, The patch should be perfect for home/lab deployments. A tight ‘select loop’ looks like the exact culprit: % time seconds usecs/call calls errors syscall * * * 63.26 0.053786 0 307412 select 36.74 0.031237 0 153591 nanosleep 0.00 0.000000 0 157 127 read 0.00 0.000000 0 153 write 0.00 0.000000 0 2 stat 0.00 0.000000 0 16 kill 0.00 0.000000 0 8 getrusage 0.00 0.000000 0 1 restart\_syscall * * * 100.00 0.085023 461340 127 total -Dave ---
**Author:** ![Dave\_Crawford](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@Dave\_Crawford](https://community.zeek.org/u/Dave_Crawford)\ **Post date:** [November 25, 2016, 5:34pm UTC](https://community.zeek.org/t/bro-2-5-cpu-usage/4511/4 "2016-11-25T17:34:43Z")
Thanks again Justin, the CPU now sits down around 3% on extremely low traffic links. ---
**Author:** ![Michael\_Shirk](https://avatars.discourse-cdn.com/v4/letter/m/aeb1de/32.png) [@Michael\_Shirk](https://community.zeek.org/u/Michael_Shirk)\ **Post date:** [November 25, 2016, 5:43pm UTC](https://community.zeek.org/t/bro-2-5-cpu-usage/4511/5 "2016-11-25T17:43:48Z")
Is this something worthy of a feature request for low bandwidth setups? In addition to something like this, I have to do a patch for very low network traffic with bro cron reporting network traffic has stopped on the monitoring interface. ---
**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\ **Post date:** [November 25, 2016, 6:54pm UTC](https://community.zeek.org/t/bro-2-5-cpu-usage/4511/6 "2016-11-25T18:54:16Z")
Regarding broctl, you can disable the "not seeing any packets" warnings if you set this in your etc/broctl.cfg: StatsLogEnable = 0 Doing so will also disable logging to broctl's stats.log (note: this is NOT the stats.log that Bro itself logs), which I'm guessing most people don't need anyway. ---
**Author:** ![Drew\_Dixon](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@Drew\_Dixon](https://community.zeek.org/u/Drew_Dixon)\ **Post date:** [November 28, 2016, 6:19pm UTC](https://community.zeek.org/t/bro-2-5-cpu-usage/4511/7 "2016-11-28T18:19:47Z")
Would it be possible for someone quantify what a low bandwidth/low traffic setup might be in terms of a bandwidth unit of measurement range where Justin’s patch would be advised to be used? I.E. Kbps/Mbps etc. What would be a cut-off bandwidth/traffic rate value where it would not be advisable that this patch be used? ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/bro-2-5-cpu-usage/4511/8 "2022-05-06T15:44:20Z")