From 694bff11acc879599c189eb2515ced19236065a3 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Fri, 11 Nov 2022 14:37:12 +0100 Subject: [PATCH] doc: add rule profiling information --- doc/userguide/rule-management/index.rst | 1 + .../rule-management/rule-profiling.rst | 28 +++++++++++++++++++ 2 files changed, 29 insertions(+) create mode 100644 doc/userguide/rule-management/rule-profiling.rst diff --git a/doc/userguide/rule-management/index.rst b/doc/userguide/rule-management/index.rst index b38ee566a5..633824f54a 100644 --- a/doc/userguide/rule-management/index.rst +++ b/doc/userguide/rule-management/index.rst @@ -6,3 +6,4 @@ Rule Management suricata-update adding-your-own-rules rule-reload + rule-profiling diff --git a/doc/userguide/rule-management/rule-profiling.rst b/doc/userguide/rule-management/rule-profiling.rst new file mode 100644 index 0000000000..fa94df3d05 --- /dev/null +++ b/doc/userguide/rule-management/rule-profiling.rst @@ -0,0 +1,28 @@ +Rules Profiling +=============== + +If Suricata is built with the --enable-profiling-rules then the ruleset profiling +can be activated on demand from the unix socket and dumped from it. + +To start profiling :: + + surictasc -c ruleset-profile-start + +To stop profiling :: + + surictasc -c ruleset-profile-stop + +To dump profiling :: + + suricatasc -c ruleset-profile + +A typical scenario to get rules performance would be :: + + surictasc -c ruleset-profile-start + sleep 30 + surictasc -c ruleset-profile-stop + suricatasc -c ruleset-profile + +On busy systems, using the sampling capability to capture performance +on a subset of packets can be obtained via the `sample-rate` variable +in the `profiling` section. -- 2.47.2