On Wed, Jun 6, 2018 at 2:10 PM Azoff, Justin S wrote:
> I haven't noticed a huge difference on a real multi process cluster, at least
> not a 30x change, so this is odd that pcap processing is so much slower.
> Especially since broker should be completely disabled when pcap files are
> being
, so your feedback is
especially important/helpful.
> # ~1GB file time (old)
>
> $ time /hostname/bro-devel/bin/bro -r
> 20180606-1049-prodfilers-truncated_0_20180606104904.pcap master.bro
>
>
>
> real0m2.294s
>
> user0m1.862s
>
> sys 0m0.385
rnel] [k] _raw_spin_lock
>
> Is the Bro development team still optimizing the Broker/Actor framework? It
> might be helpful to have a way to disable Broker for those of us who haven’t
> migrated to it yet.
>
> # ~1GB file time (old)
> $ time /hostna
haven't
migrated to it yet.
# ~1GB file time (old)
$ time /hostname/bro-devel/bin/bro -r
20180606-1049-prodfilers-truncated_0_20180606104904.pcap master.bro
real0m2.294s
user0m1.862s
sys 0m0.385s
# ~1GB file time (new)
$ time /hostname/bro-devel/bin/bro -r
20180606-1049
