Re: How can I reduce my packet loss - bro version 2.6.3

Justin Azoff <[email protected]> Mon, 30 Sep 2019 14:32:42 -0400
Newsgroups gmane.comp.security.detection.bro
Message-ID <CAPfnCuhLD-KiQg7Vgn+w7C8WFXWjZ+=unZBr48MMemo__hpoxQ@mail.gmail.com>
On Mon, Sep 30, 2019 at 1:45 PM Kayode Enwerem <
[email protected]> wrote:

>
> I have 32 CPUs on this server and CPU model name is - AMD Opteron(tm)
> Processor 6386 SE
>

People have been having issues with older opterons like that for a long
time.  They have a lot of cores, but the single core performance is about
half that of a more recent CPU.

With 32  real cores (assuming this is a dual socket system) I'd try running
closer to 28 workers which gives you 20% more capacity over  23.

After that, you need to look at the conn.log to determine where your
capture loss is coming from by looking at the missed_bytes column.  You may
have some elephant flows that are accounting for the majority of that loss.

-- 
Justin

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek