atbohmer
December 12, 2025, 1:51pm
1
Hi,
Running suricata 8.02 (from tar) with dpdk 25.11.0 (from source) on RH 8 and HP hardware, I build a little Excel sheet to determine CPU / NUMA correctness and affinity. Although I see no duplicates in Excel comparing NIC column and numa column values (like a nic on both numa nodes), suricata complains:
[48563 - W#27-84:00.0] 2025-12-12 14:28:26 Warning: dpdk: 0000:84:00.0: NIC is on NUMA 1, 1 threads on different NUMA node(s)
So I guess I’m overlooked some setting or miscalculated somehow. Autopin is of and all nics have a dedicated number off cores and corresponding number of threats.
Any tip welcome.
Best regards,
Andre
lukashino
December 12, 2025, 9:37pm
2
Hi André,
Could you share DPDK and cpu affinity config parts from your suricata.yaml and CPU system information?
Possibly also the Excel if that could help us.
Also just to be clear – autopin is off, correct?
atbohmer
December 13, 2025, 11:19am
3
Hi Lukas,
Great thanks, much appreciated!
Autopin is of indeed, something to test later with to see how it behaves in our setup, but first suricata 8 stable up and running.
suricata8.yaml.zip (29.5 KB)
Suricata_CPU_NUMA.xlsx.zip (13.7 KB)
vjulien
December 13, 2025, 11:32am
4
Can you try removing the extra interface-specific-cpu-set headers. I believe each additional one will overwrite the previous one, so:
interface-specific-cpu-set:
- interface: 0000:10:00.0
cpu: [ "6-31" ]
mode: "exclusive"
prio:
high: [ "all" ]
default: "medium"
- interface: 0000:84:00.0
cpu: [ "37-63"]
mode: "exclusive"
prio:
high: [ "all" ]
default: "medium"
- interface: 0000:10:00.1
cpu: [ "64-79"]
mode: "exclusive"
prio:
high: [ "all" ]
default: "medium"
- interface: 0000:0f:00.0
cpu: [ "80-95"]
mode: "exclusive"
prio:
high: [ "all" ]
default: "medium"
- interface: 0000:84:00.1
cpu: [ "96-113"]
mode: "exclusive"
prio:
high: [ "all" ]
default: "medium"
atbohmer
December 13, 2025, 12:02pm
5
Ah thanks, but to no avail bummer.
[380485 - W#27-84:00.0] 2025-12-13 13:01:25 Warning: dpdk: 0000:84:00.0: NIC is on NUMA 1, 1 threads on different NUMA node(s)
vjulien
December 13, 2025, 12:14pm
6
Can you share the output of lstopo?
atbohmer
December 13, 2025, 12:16pm
7
vjulien:
lstopo
]# lstopo
vjulien
December 13, 2025, 12:22pm
8
10:00.1 seems to be on NUMA 0, but these cores are on 1, right?
- interface: 0000:10:00.1
cpu: [ "64-79"]
mode: "exclusive"
prio:
high: [ "all" ]
default: "medium"
atbohmer
December 13, 2025, 12:30pm
9
vjulien:
0000:10:00.1
NUMA node0 CPU(s): 0-31,64-95
]# cat /sys/bus/pci/devices/0000:10:00.1/numa_node
I think you’re wrong? Have to go, daughter is waiting, have a nice weekend and thanks for the quick response!
lukashino
December 14, 2025, 9:25pm
10
I would wonder what the logs say with -vvvv the command-line startup option. There you can see to which CPU the worker is actually affined.
...
Setting affinity for thread ...
...
Your CPU affinity seems correct to me. If you have applied Victor’s catch correctly and the affinity above is as expected then the issue is only in that warning. If some thread is affined to a CPU outside the desired range then we could look into the affinity settings.
Also, I wonder if it complains if you enable only one interface, e.g., 0000:10:00.1.
Thank you.
After some local maneuvers, I can try it locally too to see if something pops up with many interfaces.
atbohmer
December 15, 2025, 9:23am
11
lukashino:
-vvvv
Had a brainfart last night, how if I start at 0 and not 1 so changed:
To:
And now no “threads on different NUMA node” messages. Is this enough info or do you want to test also your suggestions?
lukashino
December 15, 2025, 9:44am
12
Great to hear that. Now that you wrote that, I think the exclusion of “management X worker” CPU set kicked in place, and that’s why 0 is not considered. (in DPDK capture mode, this is automatic)
I looked again at your original config and found that the indentation of worker-cpu-set is further than the indentation of management-cpu-set. It needs to be shifted by only one indentation level to the right from the “cpu-affinity” node. If you haven’t fixed that as you were fixing Victor’s note, then I think that might be the culprit, too. Without a worker-cpu-set defined (the parent-level node of all interface-specific-cpu-sets), it will take all cores, but now, with management cores excluded, the stars align, and workers are bound to the correct NUMA nodes.
So, perhaps it could be beneficial for both of us if you could test my suggestions, to make sure it works as it should and that your config is configured correctly.
Thank you!
atbohmer
December 15, 2025, 10:31am
13
lukashino:
worker-cpu-set
Hi Lukas,
Find attached a zip file with logs, -vvvv, management starting at 1, suricata_worker1.log, and starting at 0 suricata_worker0.log. Also the current suricata.yaml. Happy to test some more if needed.
suri.zip (58.6 KB)
lukashino
December 15, 2025, 12:31pm
14
Hi André,
the current suricata.yaml still contains the whole “worker-cpu-set” node indented too much.
This is the correct form:
threading:
set-cpu-affinity: yes
# autopin: yes
autopin: no
# Tune cpu affinity of threads. Each family of threads can be bound
# to specific CPUs.
#
# These 2 apply to the all runmodes:
# management-cpu-set is used for flow timeout handling, counters
# worker-cpu-set is used for 'worker' threads
#
# Additionally, for autofp these apply:
# receive-cpu-set is used for capture threads
# verdict-cpu-set is used for IPS verdict threads
#
cpu-affinity:
management-cpu-set:
cpu: [ "1-5","32-36" ] # include only these CPUs in affinity settings
# receive-cpu-set:
# cpu: [ 0 ] # include only these CPUs in affinity settings
# interface-specific-cpu-set:
# - interface: "enp4s0f0"
# cpu: [ 1,3,5,7,9 ]
# mode: "exclusive"
# prio:
# high: [ "all" ]
# default: "medium"
# HT enabled
worker-cpu-set:
cpu: [ "6-31","37-113" ]
mode: "exclusive"
# Use explicitly 3 threads and don't compute number by using
# detect-thread-ratio variable:
# threads: 3
prio:
low: [ 0 ]
medium: [ "1" ]
# HT enabled
default: "high"
interface-specific-cpu-set:
- interface: 0000:10:00.0
cpu: [ "6-31" ]
mode: "exclusive"
prio:
high: [ "all" ]
default: "medium"
- interface: 0000:84:00.0
cpu: [ "37-63"]
mode: "exclusive"
prio:
high: [ "all" ]
default: "medium"
- interface: 0000:10:00.1
cpu: [ "64-79"]
mode: "exclusive"
prio:
high: [ "all" ]
default: "medium"
- interface: 0000:0f:00.0
cpu: [ "80-95"]
mode: "exclusive"
prio:
high: [ "all" ]
default: "medium"
- interface: 0000:84:00.1
cpu: [ "96-113"]
mode: "exclusive"
prio:
high: [ "all" ]
default: "medium"
1 Like