From: Victor Julien <vjulien@oisf.net>
Date: Sat, 16 Dec 2023 15:45:00 +0000 (+0100)
Subject: detect/profiling: improve pcap reading performance
X-Git-Tag: suricata-8.0.0-beta1~1884
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bcb2b50cfc34430e0e91dea781c90d2259ef8f0d;p=thirdparty%2Fsuricata.git

detect/profiling: improve pcap reading performance

When reading a pcap, packet time can move much faster than wall
clock time. This would trigger many more profile syncs than before.

As the sync is using a lock to synchronize with other threads, this
is an expensive operation.

Bug: #6619.

Fixes: b591813b8690 ("profiling/rules: reduce sync logic scope")
---

diff --git a/src/detect.c b/src/detect.c
index 5cb4e6bfbc..d671a3866f 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -1797,9 +1797,11 @@ TmEcode Detect(ThreadVars *tv, Packet *p, void *data)
 
 #ifdef PROFILE_RULES
     /* aggregate statistics */
-    if (SCTIME_SECS(p->ts) != det_ctx->rule_perf_last_sync) {
+    struct timeval ts;
+    gettimeofday(&ts, NULL);
+    if (ts.tv_sec != det_ctx->rule_perf_last_sync) {
         SCProfilingRuleThreatAggregate(det_ctx);
-        det_ctx->rule_perf_last_sync = SCTIME_SECS(p->ts);
+        det_ctx->rule_perf_last_sync = ts.tv_sec;
     }
 #endif