Project

General

Profile

Actions

Bug #1578

closed

Reload rules under low traffic hangs

Added by Eric Leblond about 9 years ago. Updated over 8 years ago.

Status:
Closed
Priority:
Low
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

In autofp mode and with a multicore box it is possible the reload of rules get stuck between the two following log messages:

[23912] 16/10/2015 -- 15:44:53 - (detect-engine.c:593) <Notice> (DetectEngineReloadThreads) -- rule reload starting
[23912] 16/10/2015 -- 15:44:58 - (detect-engine.c:747) <Notice> (DetectEngineReloadThreads) -- rule reload complete

On a system with 8 cores, the auto mode of af-packet is starting 8 capture threads and this can cause some threads to get stuck in the DetectEngineReloadThreads function looping and waiting for threads to be ready:

@while (!TmThreadsCheckFlag(tv, THV_RUNNING_DONE)) {
     usleep(100);
}@

Or at line detect-engine.c:703

We should check the thread causing the issue and see how we can implement the timoeout as the delay to reload can be really long.

Actions

Also available in: Atom PDF