Switching default DS compression to gzip.
Would you mind elaborating why? I thought lzo is faster than gzip.
Matthias
Switching default DS compression to gzip.
Would you mind elaborating why? I thought lzo is faster than gzip.
Matthias
That's right, but gzip compresses better. Compression runs in a
separate thread, so CPU load shouldn't matter that much (I hope).
Robin
That's right, but gzip compresses better. Compression runs in a
separate thread, so CPU load shouldn't matter that much (I hope).
That makes sense, theoretically. I could see it working if the cores
are not too oversubscribed. As I lost track of how many threads Bro
currently spawns with logging and input framework, I have no clue how
this looks like in practice; crossing my fingers...
Matthias