# Performance: usec feedback

**URL:** <https://forum.suricata.io/t/performance-usec-feedback/112>\
**Category:** Help\
**Created:** [March 26, 2020, 12:15pm UTC](https://forum.suricata.io/t/performance-usec-feedback/112 "2020-03-26T12:15:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pevma](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/pevma/32/29_2.png) [@pevma](https://forum.suricata.io/u/pevma)\
**Post date:** [March 26, 2020, 12:15pm UTC](https://forum.suricata.io/t/performance-usec-feedback/112/1 "2020-03-26T12:15:18Z")

</div>

Seems if you are sitting on kernel 4.19+ it gets easier to gather/display much needed stats as there are better/improved/newer tools available.  
One of those is pretty easy to install:

```
apt-get install bpfcc-tools python3-bpfcc

```

and to use:

```
cpudist-bpfcc -p `pidof suricata` 600 1

```

This would basically show all usec done by Suricata for the 10min period  
It can also be done per thread which can come very handy in troubleshooting:

```
cpudist-bpfcc -L -p `pidof suricata` 600 1

```

This (screenshot attached) is what I noticed on a heavily tested machine inside a peak of 10min. Wondering out of curiosity what everyone else is seeing . Runing 6.0.0-dev (26123e05f 2020-03-20) with AFPv3, 40 threads, 4.19 kernel.

 ![Screenshot from 2020-03-26 13-11-17](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/1X/87a4df5f87dc4f578dbb641644ddd231ae2b3d06.png)

---

<div class="post-metadata">

**Author:** ![pevma](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/pevma/32/29_2.png) [@pevma](https://forum.suricata.io/u/pevma)\
**Post date:** [March 26, 2020, 2:22pm UTC](https://forum.suricata.io/t/performance-usec-feedback/112/2 "2020-03-26T14:22:51Z")

</div>

There are some examples and explanation of how the tool can be used here - [https://github.com/iovisor/bcc/blob/master/tools/cpudist\_example.txt](https://github.com/iovisor/bcc/blob/master/tools/cpudist_example.txt)  
and ways to detect lock contention and on-CPU/off-CPU time.

---

<div class="post-metadata">

**Author:** ![dbcfd](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/dbcfd/32/21_2.png) [@dbcfd](https://forum.suricata.io/u/dbcfd)\
**Post date:** [April 7, 2020, 4:36pm UTC](https://forum.suricata.io/t/performance-usec-feedback/112/3 "2020-04-07T16:36:22Z")

</div>

That looks awesome. Going to try throwing it at a couple of things, including suricata.

---

<div class="post-metadata">

**Author:** ![pevma](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/pevma/32/29_2.png) [@pevma](https://forum.suricata.io/u/pevma)\
**Post date:** [April 7, 2020, 8:23pm UTC](https://forum.suricata.io/t/performance-usec-feedback/112/4 "2020-04-07T20:23:40Z")

</div>

Nice, thanks! Looking forward to the feedback - it would be helpful to “calibrate” any conclusions i think.  
Interested on PID views as well. I could follow up with parallel findings/printouts and we can maybe kind of compare results.