> On Sep 7, 2018, at 4:41 PM, Azoff, Justin S <jaz...@illinois.edu> wrote: > > Before, cpu maxed out but spending 60% in user and 30% in system > After, cpu maxed out but spending 12% in user and 80% in system >
I did some more testing and profiling and figured out what is going on.. The new version is much more efficient, so it's spending a lot less time in user space and a lot more time in the kernel fetching packets. On the managers, overall CPU using is a bit lower, but I think some of that is from removing all uses of &synchronized, especially for large input tables. If anything there's just a slight overhead in the bro-myricom plugin in how it uses snf_ring_recv to receive a single packet instead of snf_ring_recv_many to grab multiple packets like how af_packet works. I'd look into fixing it but we are moving to intel 40g cards anyway. — Justin Azoff _______________________________________________ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
