High CPU Usage
Jorge Garcia Rodriguez <[email protected]> Mon, 16 Dec 2019 11:38:20 +0000
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
--===============1522547763==
Content-Language: es-ES
Content-Type: multipart/alternative;
boundary="_000_D6E3E7F0075CEF4CB16D0A627912409A35E0F91FGalileosiaes_"
--_000_D6E3E7F0075CEF4CB16D0A627912409A35E0F91FGalileosiaes_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hi, everyone
I'm facing an issue regarding a high CPU usage in a Zeek machine, this caus=
e packets dropped whenever a core reach 100% usage. We always have 1 core a=
t 100% load and the others are around 60-80%
Name Type Host Pid VSize R=
ss Cpu
logger logger localhost 4666 2G 121=
M 53%
manager manager localhost 4712 584M 114M 40=
%
proxy-1 proxy localhost 4757 639M 148M =
20%
worker-1-1 worker localhost 4934 884M 393M =
53%
worker-1-2 worker localhost 4893 1G 596M =
73%
worker-1-3 worker localhost 4890 1G 592M =
80%
worker-1-4 worker localhost 4895 887M 395M =
46%
worker-1-5 worker localhost 4935 4G 3G =
106%
worker-1-6 worker localhost 4901 877M 385M =
40%
worker-1-7 worker localhost 4911 1G 581M =
66%
worker-1-8 worker localhost 4906 879M 389M =
40%
worker-1-9 worker localhost 4937 1G 576M =
80%
worker-1-10 worker localhost 4920 881M 391M 46=
%
We have the next specifications :
-x 1Intel Xeon E-2136 3.3GHz, 12M cache, 6C/12T, turbo (80W)
-64GB RAM
- And we are using PF_Ring to balance de traffic.
The traffic that this Zeek manage is about 1,5GB/s with peaks of 2,5 at ma=
x.
We don't know if this is a normal behavior or we need more Hardware to mana=
ge this amount of traffic or something that we have bad in the configuratio=
n.
The node.cfg is the next one:
[logger]
type=3Dlogger
host=3Dlocalhost
[manager]
type=3Dmanager
host=3Dlocalhost
[proxy-1]
type=3Dproxy
host=3Dlocalhost
[worker-1]
type=3Dworker
host=3Dlocalhost
interface=3Dp1p1
lb_method=3Dpf_ring
lb_procs=3D10
pin_cpus=3D0,1,2,3,4,5,6,7,8,9
We have been testing different solutions posted before but nothing seems to=
take effect.
I hope you can help me improve this. Also, is there a way to reduce the amo=
unt of CPU that Zeek use? For example disabling some scripts or something l=
ike that?
Thank you all.
Best Regards!
Jorge Garc=EDa Rodr=EDguez
Technical Consultant
Security Infrastructures
[email protected]<mailto:[email protected]>
Grupo SIA
Avda.Europa,2 - Alcor Plaza, Edificio B - Parque Oeste Alcorc=F3n
28922 Alcorc=F3n - Madrid
Tlf: +34 902 480 580<nxphone:+34%20902%20480%20580> Fax: +34 91 307 79 80=
<nxphone:+34%2091%20307%2079%2080>
www.siainternational.com<http://www.siainternational.com/>
delivering value
This e-mail and any attached files are intended solely for the addresse/s i=
dentified herein. It may contain confidential and/or legally privileged inf=
ormation and may not necessarily represent the opinion of SIA.
No legally binding commitments will be created by this E-mail message. Wher=
e we intend to create legally binding commitments these will be made throug=
h hard copy correspondence or documents. If you receive this message by mis=
take, please immediately notify the sender and delete it since you are not =
authorized to use, disclose, distribute, print or copy all or part of the c=
ontained information Thank you. It is understood that the message was sent =
to you accidentally, although you appear as the addressee, you can see from=
the frame of existing relations that you were not the final addressee.
--_000_D6E3E7F0075CEF4CB16D0A627912409A35E0F91FGalileosiaes_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<meta name=3D"Generator" content=3D"Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML con formato previo Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.EstiloCorreo17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.HTMLconformatoprevioCar
{mso-style-name:"HTML con formato previo Car";
mso-style-priority:99;
mso-style-link:"HTML con formato previo";
font-family:"Courier New";
mso-fareast-language:ES;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"ES" link=3D"blue" vlink=3D"purple">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span lang=3D"EN-US">Hi, everyone <o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">I’m facing an issue regar=
ding a high CPU usage in a Zeek machine, this cause packets dropped wheneve=
r a core reach 100% usage. We always have 1 core at 100% load and the other=
s are around 60-80%<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Name &nb=
sp; Type =
Host &nbs=
p; =
Pid VSize Rss =
Cpu =
;
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">logger &=
nbsp; logger &n=
bsp; localhost =
4666 2G &=
nbsp; 121M 53%
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">manager manager &nbs=
p; localhost &nb=
sp; 4712 584M =
114M 40%
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">proxy-1 =
proxy &n=
bsp; localhost =
4757 639M 148M  =
; 20%
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">worker-1-1 worker&n=
bsp; localhost =
4934 884M 393=
M 53%
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">worker-1-2 worker&n=
bsp; localhost =
4893 1G =
596M 73=
%
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">worker-1-3 worker&n=
bsp; localhost =
4890 1G =
592M 80=
%
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">worker-1-4 worker&n=
bsp; localhost =
4895 887M 395=
M 46%
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">worker-1-5 worker&n=
bsp; localhost =
4935 4G =
3G  =
; 106%
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">worker-1-6 worker&n=
bsp; localhost =
4901 877M 385=
M 40%
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">worker-1-7 worker&n=
bsp; localhost =
4911 1G =
581M 66=
%
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">worker-1-8 worker&n=
bsp; localhost =
4906 879M 389=
M 40%
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">worker-1-9 worker&n=
bsp; localhost =
4937 1G =
576M 80=
%
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">worker-1-10 worker =
localhost &nbs=
p; 4920 881M 391M &nb=
sp; 46%
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">We have the next specifications=
:<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal">-x 1Intel Xeon E-2136 3.3GHz, 12M cache, 6C/12T, tur=
bo (80W)<o:p></o:p></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">-64GB RAM<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">- And we are using PF_Ring to b=
alance de traffic.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">The traffic that this Zeek mana=
ge is about 1,5GB/s with peaks of 2,5 at max.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">We don’t know if this is =
a normal behavior or we need more Hardware to manage this amount of traffic=
or something that we have bad in the configuration.
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">The node.cfg is the next one:<o=
:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">[logger]<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">type=3Dlogger<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">host=3Dlocalhost<o:p></o:p></sp=
an></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">[manager]<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">type=3Dmanager<o:p></o:p></span=
></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">host=3Dlocalhost<o:p></o:p></sp=
an></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">[proxy-1]<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">type=3Dproxy<o:p></o:p></span><=
/p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">host=3Dlocalhost<o:p></o:p></sp=
an></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">[worker-1]<o:p></o:p></span></p=
>
<p class=3D"MsoNormal"><span lang=3D"EN-US">type=3Dworker<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">host=3Dlocalhost<o:p></o:p></sp=
an></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">interface=3Dp1p1<o:p></o:p></sp=
an></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">lb_method=3Dpf_ring<o:p></o:p><=
/span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">lb_procs=3D10<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">pin_cpus=3D0,1,2,3,4,5,6,7,8,9<=
o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">We have been testing different =
solutions posted before but nothing seems to take effect.<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">I hope you can help me improve =
this. Also, is there a way to reduce the amount of CPU that Zeek use? For e=
xample disabling some scripts or something like that?<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Thank you all.<o:p></o:p></span=
></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Best Regards!<o:p></o:p></span>=
</p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><b><span lang=3D"EN-US" style=3D"font-size:10.0pt;fo=
nt-family:"Verdana","sans-serif";color:#0099CA;mso-fare=
ast-language:ES">Jorge Garc=EDa Rodr=EDguez</span></b><span lang=3D"EN-US" =
style=3D"font-size:7.5pt;font-family:"Verdana","sans-serif&q=
uot;;color:black;mso-fareast-language:ES"><br>
</span><span lang=3D"EN-US" style=3D"font-size:7.5pt;font-family:"Verd=
ana","sans-serif";color:#0099CA;mso-fareast-language:ES">Tec=
hnical Consultant<br>
Security Infrastructures<br>
</span><span style=3D"font-size:7.5pt;font-family:"Verdana","=
;sans-serif";color:black;mso-fareast-language:ES"><a href=3D"mailto:jg=
[email protected]"><span lang=3D"EN-US" style=3D"color:blue">[email protected]</s=
pan></a></span><span lang=3D"EN-US" style=3D"color:black;mso-fareast-langua=
ge:ES"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><b><span style=3D"font-size:10.0pt;font-family:"=
;Verdana","sans-serif";color:gray;mso-fareast-language:ES">G=
rupo SIA</span></b><span style=3D"font-size:7.5pt;font-family:"Verdana=
","sans-serif";color:#0099CA;mso-fareast-language:ES"><br>
</span><span style=3D"font-size:7.5pt;font-family:"Verdana","=
;sans-serif";color:gray;mso-fareast-language:ES">Avda.Europa,2 - Alcor=
Plaza, Edificio B - Parque Oeste Alcorc=F3n</span><span style=3D"font-size=
:7.5pt;font-family:"Verdana","sans-serif";color:#0099CA=
;mso-fareast-language:ES"><br>
</span><span style=3D"font-size:7.5pt;font-family:"Verdana","=
;sans-serif";color:gray;mso-fareast-language:ES">28922 Alcorc=F3n - Ma=
drid</span><span style=3D"font-size:7.5pt;font-family:"Verdana",&=
quot;sans-serif";color:#0099CA;mso-fareast-language:ES"><br>
</span><span style=3D"font-size:7.5pt;font-family:"Verdana","=
;sans-serif";color:gray;mso-fareast-language:ES">Tlf: <a href=3D"=
nxphone:+34%20902%20480%20580"><span style=3D"color:blue">+34 902 4=
80 580</span></a> Fax: <a href=3D"nxphone:+34%2091%203=
07%2079%2080"><span style=3D"color:blue">+34
91 307 79 80</span></a></span><span style=3D"font-size:7.5pt;font-family:&=
quot;Verdana","sans-serif";color:#0099CA;mso-fareast-languag=
e:ES"><br>
</span><span style=3D"color:black;mso-fareast-language:ES"><a href=3D"http:=
//www.siainternational.com/" target=3D"_BLANK" title=3D"http://www.siainter=
national.com/"><span style=3D"font-size:7.5pt;font-family:"Verdana&quo=
t;,"sans-serif";color:blue">www.siainternational.com</span></a><o=
:p></o:p></span></p>
<p class=3D"MsoNormal"><b><span lang=3D"EN-US" style=3D"font-size:7.5pt;fon=
t-family:"Verdana","sans-serif";color:gray;mso-fareast-=
language:ES">delivering value<o:p></o:p></span></b></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:7.5pt;font-f=
amily:"Times New Roman","serif";color:gray;mso-fareast-=
language:ES">This e-mail and any attached files are intended solely for the=
addresse/s identified herein. It may contain confidential
and/or legally privileged information and may not necessarily represent th=
e opinion of SIA.
</span><span lang=3D"EN-US" style=3D"mso-fareast-language:ES"><o:p></o:p></=
span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:7.5pt;font-f=
amily:"Times New Roman","serif";color:gray;mso-fareast-=
language:ES">No legally binding commitments will be created by this E-mail =
message. Where we intend to create legally binding commitments
these will be made through hard copy correspondence or documents. If you r=
eceive this message by mistake, please immediately notify the sender and de=
lete it since you are not authorized to use, disclose, distribute, print or=
copy all or part of the contained
information Thank you. It is understood that the message was sent to you a=
ccidentally, although you appear as the addressee, you can see from the fra=
me of existing relations that you were not the final addressee.</span><span=
lang=3D"EN-US" style=3D"mso-fareast-language:ES"><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:black;mso-fareas=
t-language:ES"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>
--_000_D6E3E7F0075CEF4CB16D0A627912409A35E0F91FGalileosiaes_--
--===============1522547763==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============1522547763==--