From: Eric Leblond <el@stamus-networks.com>
Date: Wed, 8 Nov 2023 20:18:33 +0000 (+0100)
Subject: profiling: add option to active rules profiling at start
X-Git-Tag: suricata-7.0.6~16
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8baa505c72e22c6991ca0767a6547805e304d428;p=thirdparty%2Fsuricata.git

profiling: add option to active rules profiling at start

When replaying a pcap file, it is not possible to get rules
profiling because it has to be activated from the unix socket.
This patch adds a new option to be able to activate profiling
collection at start so a pcap run can get rules profiling
information.

(cherry picked from commit eecb3440e21c428e86bc60e1bbe5808ef4c27a6c)
---

diff --git a/src/util-profiling.c b/src/util-profiling.c
index e1f19ad20c..4473b57dbd 100644
--- a/src/util-profiling.c
+++ b/src/util-profiling.c
@@ -1430,6 +1430,7 @@ void SCProfilingInit(void)
     SC_ATOMIC_INIT(profiling_rules_active);
     SC_ATOMIC_INIT(samples);
     intmax_t rate_v = 0;
+    ConfNode *conf;
 
     (void)ConfGetInt("profiling.sample-rate", &rate_v);
     if (rate_v > 0 && rate_v < INT_MAX) {
@@ -1446,6 +1447,11 @@ void SCProfilingInit(void)
         else
             SCLogInfo("profiling runs for every packet");
     }
+
+    conf = ConfGetNode("profiling.rules");
+    if (ConfNodeChildValueIsTrue(conf, "active")) {
+        SC_ATOMIC_SET(profiling_rules_active, 1);
+    }
 }
 
 /* see if we want to profile rules for this packet */
diff --git a/suricata.yaml.in b/suricata.yaml.in
index 052eef93fd..458360b1e6 100644
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -1812,6 +1812,10 @@ profiling:
     enabled: yes
     filename: rule_perf.log
     append: yes
+    # Set active to yes to enable rules profiling at start
+    # if set to no (default), the rules profiling will have to be started
+    # via unix socket commands.
+    #active:no
 
     # Sort options: ticks, avgticks, checks, matches, maxticks
     # If commented out all the sort options will be used.