detect/profiling: improve pcap reading performance

When reading a pcap, packet time can move much faster than wall
clock time. This would trigger many more profile syncs than before.

As the sync is using a lock to synchronize with other threads, this
is an expensive operation.

Bug: #6619.

Fixes: b591813b8690 ("profiling/rules: reduce sync logic scope")
(cherry picked from commit bcb2b50cfc34430e0e91dea781c90d2259ef8f0d)

diff --git a/src/detect.c b/src/detect.c
index 5cb4e6bfbc443e02e07a3a5f60bdd1c4bfe2e793..d671a3866fa5a932787886ce7c633e5f2064dd8c 100644 (file)
--- a/src/detect.c
+++ b/src/detect.c
@@ -1797,9 +1797,11 @@ TmEcode Detect(ThreadVars *tv, Packet *p, void *data)
 
 #ifdef PROFILE_RULES
     /* aggregate statistics */
-    if (SCTIME_SECS(p->ts) != det_ctx->rule_perf_last_sync) {
+    struct timeval ts;
+    gettimeofday(&ts, NULL);
+    if (ts.tv_sec != det_ctx->rule_perf_last_sync) {
         SCProfilingRuleThreatAggregate(det_ctx);
-        det_ctx->rule_perf_last_sync = SCTIME_SECS(p->ts);
+        det_ctx->rule_perf_last_sync = ts.tv_sec;
     }
 #endif