Bug #4087
openexcessive CPU usage on Windows with --pcap-file-continuous option
Description
"I'm writing to you for a bug I met on Windows with Suricata. The bug covers version at least 5.0.3 and 6.0.0.
Let's run suricata with command:
suricata -r .\empty_folder --pcap-file-continuous
Actually, there's no file under the folder. And I expect suricata to sleep and sleep, waiting for new incoming files. But the suricata just cost 100% of the CPU. I guess the bug is related to this code:
/src/source-pcap-file-directory-helper.c:
while (status == TM_ECODE_OK) {
//loop while directory is ok
SCLogInfo("Processing pcaps directory s, files must be newer than %" PRIuMAX " and older than %" PRIuMAX,
ptv->filename, (uintmax_t)SCTimespecAsEpochMillis(&ptv->shared->last_processed),
(uintmax_t)SCTimespecAsEpochMillis(&older_than));
status = PcapDirectoryDispatchForTimeRange(ptv, &older_than);
if (ptv->should_loop &x%x status == TM_ECODE_OK) {
sleep(poll_seconds);
.......
Maybe the sleep() just does nothing on Windows. I'm not sure whether it's the really cause."
Updated by Victor Julien over 2 years ago
- Related to Bug #4370: the latest release of Suricata V6.0.1 for Windows use high CPU added