Please include the following information with your help request:
- Suricata version : 7.0.X
- Operating system and/or Linux distribution : Linux 6.6.52-yocto-standard+
- How you installed Suricata (from source, packages, something else) : source
My current threading config is DISABLED.
threading:
set-cpu-affinity: no
- cpu-affinity:*
-
- management-cpu-set:*
-
cpu: [ 0 ] # include only these CPUs in affinity settings* -
- receive-cpu-set:*
-
cpu: [ 0 ] # include only these CPUs in affinity settings* -
- worker-cpu-set:*
-
cpu: [ "all" ]* -
mode: "exclusive"* -
# Use explicitly 3 threads and don't compute number by using* -
# detect-thread-ratio variable:* -
# threads: 3* -
prio:* -
low: [ 0 ]* -
medium: [ "1-2" ]* -
high: [ 3 ]* -
default: "medium"*
And the suricata thread behavior is as below:
/home/admin# ps -T -p 45320
- PID SPID TTY TIME CMD*
- 45320 45320 ? 00:00:02 Suricata-Main*
- 45320 45383 ? 00:00:00 W#01-ids*
- 45320 45384 ? 00:00:00 W#02-ids*
- 45320 45385 ? 00:00:00 W#03-ids*
- 45320 45386 ? 00:00:00 W#04-ids*
- 45320 45387 ? 00:00:00 FM#01*
- 45320 45388 ? 00:00:00 FR#01*
My requirement is to run suricata with 2 worker threads and rest of the things should match with above output (ps -T -p 45320), what changes shall I do as part of threading other than set-cpu-set to yes and thread to 2.
And my query is when set-cpu-affinity was disabled (set-cpu-affinity: no), suricata had 4 worker threads running on 4 different CPU Cores, whether these cores were exclusive for suricata ?
Kindly answer the queries.
Thanks,
Kamal