Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Suricata - increase in CPU use after upgrade to v6

    Scheduled Pinned Locked Moved IDS/IPS
    22 Posts 4 Posters 2.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      digdug3 @bmeeks
      last edited by

      @bmeeks Looks like suricata 6.0.4 has been released with a "fix":
      Suricata master

      bmeeksB 1 Reply Last reply Reply Quote 0
      • bmeeksB
        bmeeks @digdug3
        last edited by bmeeks

        @digdug3 said in Suricata - increase in CPU use after upgrade to v6:

        @bmeeks Looks like suricata 6.0.4 has been released with a "fix":
        Suricata master

        No, you are misreading the way Victor marks things. That change was actually released in Suricata 6.0.3 back in the earlier part of this year. That particular change was merged into what was then the 6.0.x master branch back in February, so it came out with 6.0.3. You can verify that by looking in the source code for Suricata 6.0.3. Here is the line from the flow-manager.c file in the 6.0.3 source code:

        #ifdef FM_PROFILE
                struct timeval sleep_startts;
                memset(&sleep_startts, 0, sizeof(sleep_startts));
                gettimeofday(&sleep_startts, NULL);
        #endif
                usleep(250);
        

        Notice the change to the usleep() timer value is the same 250 microseconds. So that fix is already in the pfSense Suricata package. The change had minimal impact according to later postings on the Suricata forum. The overall ticket is still open for some kind of dynamic solution to the issue.

        Here is the full list of actual changes in Suricata 6.0.4: https://redmine.openinfosecfoundation.org/versions/169. There is no mention in there of the usleep() CPU utilization bug.

        D 1 Reply Last reply Reply Quote 0
        • D
          digdug3 @bmeeks
          last edited by

          @bmeeks You are right (of course!), I misread... Hope they find a solution soon.

          bmeeksB 1 Reply Last reply Reply Quote 0
          • bmeeksB
            bmeeks @digdug3
            last edited by

            @digdug3 said in Suricata - increase in CPU use after upgrade to v6:

            @bmeeks You are right (of course!), I misread... Hope they find a solution soon.

            Hopefully they will.

            1 Reply Last reply Reply Quote 0
            • NollipfSenseN
              NollipfSense @darcey
              last edited by

              @darcey said in Suricata - increase in CPU use after upgrade to v6:

              pfSense is virtualised, in Proxmox, with 2 cores i7-3770S and 4GB RAM.

              I would think the 4GB RAM for host and guest could be your problem unless that's allotted for guest only and even then, how many rules you have enabled could play significantly.

              pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
              pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

              D 1 Reply Last reply Reply Quote 0
              • D
                darcey @NollipfSense
                last edited by

                @nollipfsense Each suricata process uses around 700MB. The PVE host has an i7-3770S and 32GB RAM and serves me well. Of that, the pfsense guest is allocated 4GB and 2 cpus and even that level of resource allocation is somewhat under utilised. But cpu demand changes considerably with suricata 6. I'm sticking with suricata 5 for the time being.

                D 1 Reply Last reply Reply Quote 1
                • D
                  digdug3 @darcey
                  last edited by

                  @darcey @NollipfSense It's a KVM issue with usleep in suricata 6.x, but also some low level bare metal machines have it.

                  D 1 Reply Last reply Reply Quote 0
                  • D
                    darcey @digdug3
                    last edited by

                    @digdug3 said in Suricata - increase in CPU use after upgrade to v6:

                    It's a KVM issue with usleep in suricata 6.x, but also some low level bare metal machines have it.

                    Yes, I'm regularly revisiting that thread. I wonder what, if any, options might mitigate this issue in the meantime. kvm module options were hinted at but they seem limited and would affect all VMs. Then there are qemu options, but I wouldn't know where to start. I'm currently running pfsense in a standard proxmox i440fx vm with host cpu, all network interfaces based on linux bridges, and no passthrough devices. Nothing fancy.

                    D 1 Reply Last reply Reply Quote 0
                    • D
                      digdug3 @darcey
                      last edited by

                      @darcey Could you try to disable "Enable HTTP log" and restart Suricata? It looks like the load is cut down by +50%

                      D 1 Reply Last reply Reply Quote 0
                      • D
                        darcey @digdug3
                        last edited by darcey

                        @digdug3 said:

                        Could you try to disable "Enable HTTP log" and restart Suricata? It looks like the load is cut down by +50%

                        Thanks @digdug3. I only have EVE logging enabled and, of the two interfaces monitored by suricata, only one is logging traffic. Should I have seen a noticable difference in the CPU utilisation between the two suricata processes? I don't recall that being the case. I'm back on version 5 for now so cannot test it right now. I will look more closely at the impact of logging when I next attempt the upgrade to v6. Do you have more info on that recommendation?
                        Something that seem to crop up in the discussion of this was the difference in cpu use reported in the guest vs the host. I don't recall seeing a significant difference in my case.

                        D 1 Reply Last reply Reply Quote 0
                        • D
                          digdug3 @darcey
                          last edited by

                          @darcey "Enable HTTP log" is enabled by default. I too have EVE logging on four interfaces and after disabling the "HTTP log" I saw a change in load from 5+ to a load between 2.26 and 2.70.
                          Even with EVE logging still enabled. I use pfSense on Proxmox, so your and my system are almost equal.

                          Also CPU usage was sometimes 100% and now between 20% and 50% (in pfSense itself, not in Proxmox, there the change from Suricata 5.x at 15% to Suricata 6.x at 50% is still very visible)

                          Just wanted to make sure it's not something else I changed.

                          D 1 Reply Last reply Reply Quote 0
                          • D
                            darcey @digdug3
                            last edited by darcey

                            @digdug3 I do have the standalone http log option disabled. I have basic logging (for http and several other ptotcols) enabled for eve output on one interface.
                            If I disable/reduce logging on an interface, I'd expect to see a load reduction in proportion to the volume of traffic on the interface, be it suricata 5 or 6. However the interface concerned is low traffic and the proportion of http is fairly low. I'm going to play around with it next time though. Thanks.

                            1 Reply Last reply Reply Quote 0
                            • D darcey referenced this topic on
                            • D darcey referenced this topic on
                            • bmeeksB bmeeks referenced this topic on
                            • bmeeksB bmeeks referenced this topic on
                            • bmeeksB bmeeks referenced this topic on
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.