I’m seeing ~6% CPU utilization on workers, with no traffic. Is that expected? Is there any way to minimize the CPU load?
Using AF_PACKET plugin. The cores are isolated using “isolcpus”, so nothing else should be running on them. Workers are pinned to the CPUs in the
I have a fork of 2.5 that may help. It’s intended to minimize CPU load on sensors that see low volume/sensor-local traffic. Check out the most recent commits, shout out to Justin for the basis of the tweaks. https://github.com/JonZeolla/bro/tree/topic/jonzeolla/low-volume
Thanks Jon. I’ll take a look. I should clarify.
I’m working on a multi-tenant solution with Bro, Docker, and SR-IOV. The plan is to support 10Gbps+, with VLANs as the dividers for tenants. The containerized Bro is working and I’m able to run multiple Bro instances for multiple tenants. However, when I start additional Bro containers, they each consume 6% CPU (12% for 2, 18% for 3, etc).
Would the usleep patch still apply to a high-throughput solution?