]> git.ipfire.org Git - people/ms/suricata.git/commit - src/source-pcap-file.c
Add per packet profiling.
authorVictor Julien <victor@inliniac.net>
Tue, 6 Sep 2011 14:45:45 +0000 (16:45 +0200)
committerVictor Julien <victor@inliniac.net>
Tue, 6 Sep 2011 14:45:45 +0000 (16:45 +0200)
commit820b0ded8217141906ceb10f39ff60da02c562fb
tree08f908e9a4bfd6578f412fc8da3a53818c9d61f8
parent1bd1a62526ff94c932a8fa0772b536f0678e0d1e
Add per packet profiling.

Per packet profiling uses tick based accounting. It has 2 outputs, a summary
and a csv file that contains per packet stats.

Stats per packet include:
 1) total ticks spent
 2) ticks spent per individual thread module
 3) "threading overhead" which is simply calculated by subtracting (2) of (1).

A number of changes were made to integrate the new code in a clean way:
a number of generic enums are now placed in tm-threads-common.h so we can
include them from any part of the engine.

Code depends on --enable-profiling just like the rule profiling code.

New yaml parameters:

profiling:
  # packet profiling
  packets:

    # Profiling can be disabled here, but it will still have a
    # performance impact if compiled in.
    enabled: yes
    filename: packet_stats.log
    append: yes

    # per packet csv output
    csv:

      # Output can be disabled here, but it will still have a
      # performance impact if compiled in.
      enabled: no
      filename: packet_stats.csv

Example output of summary stats:

IP ver   Proto   cnt        min      max          avg
------   -----   ------     ------   ----------   -------
 IPv4       6     19436      11448      5404365     32993
 IPv4     256         4      11511        49968     30575

Per Thread module stats:

Thread Module              IP ver   Proto   cnt        min      max          avg
------------------------   ------   -----   ------     ------   ----------   -------
TMM_DECODEPCAPFILE          IPv4       6     19434       1242        47889      1770
TMM_DETECT                  IPv4       6     19436       1107       137241      1504
TMM_ALERTFASTLOG            IPv4       6     19436         90         1323       155
TMM_ALERTUNIFIED2ALERT      IPv4       6     19436        108         1359       138
TMM_ALERTDEBUGLOG           IPv4       6     19436         90         1134       154
TMM_LOGHTTPLOG              IPv4       6     19436        414      5392089      7944
TMM_STREAMTCP               IPv4       6     19434        828      1299159     19438

The proto 256 is a counter for handling of pseudo/tunnel packets.

Example output of csv:

pcap_cnt,ipver,ipproto,total,TMM_DECODENFQ,TMM_VERDICTNFQ,TMM_RECEIVENFQ,TMM_RECEIVEPCAP,TMM_RECEIVEPCAPFILE,TMM_DECODEPCAP,TMM_DECODEPCAPFILE,TMM_RECEIVEPFRING,TMM_DECODEPFRING,TMM_DETECT,TMM_ALERTFASTLOG,TMM_ALERTFASTLOG4,TMM_ALERTFASTLOG6,TMM_ALERTUNIFIEDLOG,TMM_ALERTUNIFIEDALERT,TMM_ALERTUNIFIED2ALERT,TMM_ALERTPRELUDE,TMM_ALERTDEBUGLOG,TMM_ALERTSYSLOG,TMM_LOGDROPLOG,TMM_ALERTSYSLOG4,TMM_ALERTSYSLOG6,TMM_RESPONDREJECT,TMM_LOGHTTPLOG,TMM_LOGHTTPLOG4,TMM_LOGHTTPLOG6,TMM_PCAPLOG,TMM_STREAMTCP,TMM_DECODEIPFW,TMM_VERDICTIPFW,TMM_RECEIVEIPFW,TMM_RECEIVEERFFILE,TMM_DECODEERFFILE,TMM_RECEIVEERFDAG,TMM_DECODEERFDAG,threading
1,4,6,172008,0,0,0,0,0,0,47889,0,0,48582,1323,0,0,0,0,1359,0,1134,0,0,0,0,0,8028,0,0,0,49356,0,0,0,0,0,0,0,14337

First line of the file contains labels.

2 example gnuplot scripts added to plot the data.
54 files changed:
qa/gnuplot/plot-csv-large-pcap-file.sh [new file with mode: 0755]
qa/gnuplot/plot-csv-small-pcap-file.sh [new file with mode: 0755]
src/Makefile.am
src/alert-debuglog.c
src/alert-fastlog.c
src/alert-fastlog.h
src/alert-prelude.c
src/alert-syslog.c
src/alert-unified-alert.c
src/alert-unified-log.c
src/alert-unified2-alert.c
src/app-layer-detect-proto.c
src/counters.c
src/cuda-packet-batcher.c
src/decode-ipv4.c
src/decode.c
src/decode.h
src/detect-engine-mpm.h
src/detect-engine-threshold.c
src/detect-engine.c
src/detect-engine.h
src/detect.c
src/flow.c
src/log-droplog.c
src/log-httplog.c
src/log-pcap.c
src/output.c
src/output.h
src/respond-reject-libnet11.c
src/respond-reject.c
src/respond-reject.h
src/source-erf-dag.c
src/source-erf-file.c
src/source-ipfw.c
src/source-nfq.c
src/source-pcap-file.c
src/source-pcap.c
src/source-pfring.c
src/stream-tcp-reassemble.c
src/stream-tcp.c
src/suricata-common.h
src/suricata.c
src/threads.c
src/tm-modules.c
src/tm-modules.h
src/tm-threads-common.h [new file with mode: 0644]
src/tm-threads.c
src/tm-threads.h
src/tmqh-packetpool.c
src/util-debug.c
src/util-mpm-b2g-cuda.c
src/util-profiling.c
src/util-profiling.h
suricata.yaml