jasonish
Rules profiling
Add rules profiling build option to regular build. It is deactivated by default and need to be activated via --set commands.
conflict. I'm rebasing.
I can do it to.. You caught me in the middle of some cleanup.
How much of a perf impact is expected if this option is built in but disabled at runtime?
How much of a perf impact is expected if this option is built in but disabled at runtime?
I have a similar question. I wonder if we could run it with Suricata QA?
How much of a perf impact is expected if this option is built in but disabled at runtime?
I have a similar question. I wonder if we could run it with Suricata QA?
We run built it on Stamus appliance and just activate it from time to time via unix socket (using also sampling). No real performance impact has been seen.
Performance-wise, I think things are OK. With my own pcap-based testing, having rule profiling compiled in, but disabled, was not measurable.
However, compiling it also enabled it by default, which isn't ideal: https://github.com/OISF/suricata/blob/main-8.0.x/suricata.yaml.in#L1951
I could patch up the config as part of building the images, but I'd rather not. I wonder if this default should be changed in Suricata. I think it should, but should it be backported as well is the question I think..
Performance-wise, I think things are OK. With my own pcap-based testing, having rule profiling compiled in, but disabled, was not measurable.
However, compiling it also enabled it by default, which isn't ideal: https://github.com/OISF/suricata/blob/main-8.0.x/suricata.yaml.in#L1951
I could patch up the config as part of building the images, but I'd rather not. I wonder if this default should be changed in Suricata. I think it should, but should it be backported as well is the question I think..
It is enabled but not active by default.
It will only start computing performance when triggered via unix-socket or if active is set to yes.
Performance-wise, I think things are OK. With my own pcap-based testing, having rule profiling compiled in, but disabled, was not measurable. However, compiling it also enabled it by default, which isn't ideal: https://github.com/OISF/suricata/blob/main-8.0.x/suricata.yaml.in#L1951 I could patch up the config as part of building the images, but I'd rather not. I wonder if this default should be changed in Suricata. I think it should, but should it be backported as well is the question I think..
It is enabled but not active by default.
It will only start computing performance when triggered via unix-socket or if
activeis set to yes.
Yeah, I noticed that. Still not happy that it dumps the log file by default though.