From 1d3302240a0d86c5fe3acc6c3fb174bd4b591cfc Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Sat, 16 Dec 2023 16:45:00 +0100 Subject: [PATCH] detect/profiling: improve pcap reading performance When reading a pcap, packet time can move much faster than wall clock time. This would trigger many more profile syncs than before. As the sync is using a lock to synchronize with other threads, this is an expensive operation. Bug: #6619. Fixes: b591813b8690 ("profiling/rules: reduce sync logic scope") (cherry picked from commit bcb2b50cfc34430e0e91dea781c90d2259ef8f0d) --- src/detect.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/detect.c b/src/detect.c index 5cb4e6bfbc..d671a3866f 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1797,9 +1797,11 @@ TmEcode Detect(ThreadVars *tv, Packet *p, void *data) #ifdef PROFILE_RULES /* aggregate statistics */ - if (SCTIME_SECS(p->ts) != det_ctx->rule_perf_last_sync) { + struct timeval ts; + gettimeofday(&ts, NULL); + if (ts.tv_sec != det_ctx->rule_perf_last_sync) { SCProfilingRuleThreatAggregate(det_ctx); - det_ctx->rule_perf_last_sync = SCTIME_SECS(p->ts); + det_ctx->rule_perf_last_sync = ts.tv_sec; } #endif -- 2.47.2