From: Eric Leblond <el@stamus-networks.com>
Date: Wed, 8 Nov 2023 20:18:33 +0000 (+0100)
Subject: profiling: add option to active rules profiling at start
X-Git-Tag: suricata-8.0.0-beta1~1164
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=eecb3440e21c428e86bc60e1bbe5808ef4c27a6c;p=thirdparty%2Fsuricata.git

profiling: add option to active rules profiling at start

When replaying a pcap file, it is not possible to get rules
profiling because it has to be activated from the unix socket.
This patch adds a new option to be able to activate profiling
collection at start so a pcap run can get rules profiling
information.
---

diff --git a/src/util-profiling.c b/src/util-profiling.c
index 70b187e97a..efc22fea6e 100644
--- a/src/util-profiling.c
+++ b/src/util-profiling.c
@@ -1432,6 +1432,7 @@ void SCProfilingInit(void)
     SC_ATOMIC_INIT(profiling_rules_active);
     SC_ATOMIC_INIT(samples);
     intmax_t rate_v = 0;
+    ConfNode *conf;
 
     (void)ConfGetInt("profiling.sample-rate", &rate_v);
     if (rate_v > 0 && rate_v < INT_MAX) {
@@ -1448,6 +1449,11 @@ void SCProfilingInit(void)
         else
             SCLogInfo("profiling runs for every packet");
     }
+
+    conf = ConfGetNode("profiling.rules");
+    if (ConfNodeChildValueIsTrue(conf, "active")) {
+        SC_ATOMIC_SET(profiling_rules_active, 1);
+    }
 }
 
 /* see if we want to profile rules for this packet */
diff --git a/suricata.yaml.in b/suricata.yaml.in
index 1150f7ab9a..897c71027a 100644
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -1810,6 +1810,10 @@ profiling:
     enabled: yes
     filename: rule_perf.log
     append: yes
+    # Set active to yes to enable rules profiling at start
+    # if set to no (default), the rules profiling will have to be started
+    # via unix socket commands.
+    #active:no
 
     # Sort options: ticks, avgticks, checks, matches, maxticks
     # If commented out all the sort options will be used.