[Snort-devel] Threaded snort

Erek Adams erek at ...105...
Fri Jun 15 13:58:12 EDT 2001

On Fri, 15 Jun 2001, Sjsnort wrote:

> I can use pbind to bind snort to a processor but that won't help. Even
> without pbind, it can utilize only one CPU and after binding it with pbind,
> it would be only using one CPU. So no gain :)

Well...  Since the OS itself can no longer use the proc that you bind snort
to, it has the whole CPU to itself.  Otherwise it would be sharing the CPU
time with the OS.

> whoa!!!!! I still did pbind and guess what? After binding snort to CPU-2, it
> goes upto 80-90% usage (mpstat 5) and if i unbind it then the load seems to
> get split, mpstat shows both processors getting loads between 30-60% (one
> 20%, the other 60% and various other combinations).

Actually that is what you 'want' (I think...).  It means that snort has 100%
of one CPU to use, instead of sharing it.  If you add your numbers (60+20) you
get almost the same amount.

> Whatever, pbind doesn't look like a good idea :)

I'm not sure.  I'm still trying to get a handle on the way Solaris deals with
SMP.  Anyone a Solaris SMP wizard?

I currently run mysql bound to one proc on a ss20.  Once I did that, ACID
seemed to run a bit quicker--But that may have been wishful thinking...  :)

Erek Adams

More information about the Snort-devel mailing list