[
https://bro-tracker.atlassian.net/browse/BIT-1182?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=19908#comment-19908
]
Aashish Sharma commented on BIT-1182:
-------------------------------------
ah! that makes sense now. You are correct. I was inadvertently calling exec
framework after an entry gets removed.
Infact, thats what I was working on to fix, and I see this comment.
I will report back once I eliminate exec framework spawn for removals and make
that a batch-job ( only 1 exec call for all removals)
Thanks,
Aashish
> Input-framework thread spwan
> ----------------------------
>
> Key: BIT-1182
> URL: https://bro-tracker.atlassian.net/browse/BIT-1182
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: Bro
> Affects Versions: 2.2
> Reporter: Aashish Sharma
> Labels: input-framework
>
> Using the mode REREAD, I noticed that input-framework spawns a thread for
> every add/change/delete for the elements in the feed file.
> this is a VERY desired feature and powerful capability and works quite well
> in general settings.
> Since, all the changes in a file spawns a thread to process for: EVENT_NEW,
> EVENT_CHANGED, EVENT_REMOVED, If there are lets say 5000 Changes in the file,
> there would be 5000 threads spawned at the same time. this is still alright
> and system can handle load and processing is done in a few seconds.
> However, if I include a when statement along with exec framework usage to
> execute an action in Input::EVENT_NEW, Input::EVENT_CHANGED or
> Input::EVENT_REMOVED - all threads spawned together freezes bro from
> processing any packets at all.
> It would be nice if we can serialize this thread creation and spawn only a
> few at a time. This way we can spread out the increased load over next N mins
> instead of freezing bro to a standstill.
> (As always, please let me know if you want code to be able to re-produce this
> issue).
--
This message was sent by Atlassian JIRA
(v6.4-OD-15-055#64014)
_______________________________________________
bro-dev mailing list
bro-dev@bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
