# Performance Issues after upgrade to Zeek-6

**URL:** <https://community.zeek.org/t/performance-issues-after-upgrade-to-zeek-6/7094>\
**Category:** Zeek\
**Tags:** upgrade, performance, workers, pf-ring\
**Created:** [July 18, 2023, 9:59am UTC](https://community.zeek.org/t/performance-issues-after-upgrade-to-zeek-6/7094 "2023-07-18T09:59:02Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\
**Post date:** [July 31, 2023, 2:10pm UTC](https://community.zeek.org/t/performance-issues-after-upgrade-to-zeek-6/7094/7 "2023-07-31T14:10:46Z")

</div>

@redbaron - thank you very much for reporting. I’m able to reproduce something similar in a VM:

- pf\_ring installed via [ntop repositories](https://packages.ntop.org/) (adds /usr/local/lib to ld.conf setup)
- lb\_procs = 4, lb\_method = pf\_ring
- Replaying 10kpps mostly SSL traffic

With Zeek 5.2.2, there’s no packet drops visible through the status files in `/proc/net/pf_ring`:

```auto
root@ubuntu-01:/proc/net/pf_ring# for f in *enp6s0* ; do echo "$f $(cat $f | grep Lost) $(cat $f | grep App)" ; done
63289-enp6s0.65 Tot Pkt Lost : 0 Appl. Name : zeek-enp6s0
63292-enp6s0.64 Tot Pkt Lost : 0 Appl. Name : zeek-enp6s0
63293-enp6s0.63 Tot Pkt Lost : 0 Appl. Name : zeek-enp6s0
63294-enp6s0.62 Tot Pkt Lost : 0 Appl. Name : zeek-enp6s0

```

With Zeek 6.0, current observation is that some of the workers immediately or after a short period of tiem start dropping packets:

```auto
root@ubuntu-01:/proc/net/pf_ring# for f in *enp6s0* ; do echo "$f $(cat $f | grep Lost) $(cat $f | grep App)" ; done
73720-enp6s0.78 Tot Pkt Lost : 29138 Appl. Name : zeek-enp6s0
73721-enp6s0.81 Tot Pkt Lost : 13508 Appl. Name : zeek-enp6s0
73722-enp6s0.79 Tot Pkt Lost : 0 Appl. Name : zeek-enp6s0
73725-enp6s0.80 Tot Pkt Lost : 0 Appl. Name : zeek-enp6s0

```

CPU usage of workers dropping packets plummets.

I’ll look at more detail - this is an obvious regression and I suspect caused by IO loop or timing changes introduced in 6.0.

Thanks again!

---

_[View the full topic](https://community.zeek.org/t/performance-issues-after-upgrade-to-zeek-6/7094)._