Hi Stathis, Two questions on your current setup: 1) are you already using pmacct against a PF_RING-enabled libpcap? You made reference to this in your email; 2) Can you determine what makes CPU go to 100%? Is it traffic rate or classification? Deterimining this is key to steer further recommendations.
Cheers, Paolo On Sun, Apr 06, 2014 at 08:17:07PM +0300, Stathis Gkotsis wrote: > Hi all, > > I am using pmacctd with libpcap. My configuration is the following: > daemonize: falsepcap_filter: port 80 // only interested in HTTP > trafficplugin_pipe_size: 102400000plugin_buffer_size: 102400aggregate: > src_host,dst_host,src_port,dst_port,proto,classclassifiers: > [path_to_classifier]snaplen: 500interface: anyplugins: printprint_num_protos: > trueprint_cache_entries: 15485863print_output: csvprint_time_roundoff: > mhdprint_output_file: file.%s.%Y%m%d-%H%M.txtprint_refresh_time: 300 > I have defined one classifier and, on the machine I am using, CPU usage of > the core process is close to 100%.I have read the relevant FAQ question about > high CPU usage and applied what it proposes. > The question now is how pmacct could cope with more traffic:- are there any > other ways to optimize pmacct itself or its configuration?- I was thinking of > launching multiple pmacctd instances, each instance receiving a portion of > the traffic. This split could be done through BPF filter. How would you > split the traffic? For example, you can split based on one bit of the IP > address... The goal would be that the separate instances are balanced in > terms of CPU usage.- Is pmacct compiled with all relevant gcc optimizations? > Thanks,Stathis > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
