Hi Joan, This can be certainly improved, although it does not look a quick win. It would at very least require introducing further multi-threading in pmacctd core process - and very possibly start leveraging libpfring. This sounds all more longer-term.
I was skimming through PF_RING docs and spotted a replication capability. Imagine doing a flow-hashed replication of sniffed packets to a set of virtual (loopback?) interfaces. On each of these interfaces a pmacctd daemon would be listening. Then, if working, the feature can be included as part of the pmacctd daemon. This might be a short/mid-term solution. Cheers, Paolo On Tue, Feb 04, 2014 at 10:01:21AM +0100, Joan wrote: > Unfortunately, the good news didn't last, altought the performance is much > better it's still not enough to process the whole traffic, it seems to me > that it doesn't take advantage of the multicore from my CPU, using a single > CPU each time. Never more than one simultaneously. > Can that be improved? > > $ ps -p 15139 -L -o pid,tid,psr,pcpu > PID TID PSR %CPU > 15139 15139 2 54.6 > > PID TID PSR %CPU > 15139 15139 1 54.6 > > PID TID PSR %CPU > 15139 15139 2 54.6 > > > > > > 2014-02-04 Paolo Lucente <[email protected]>: > > > Hi Joan, > > > > Perfect, thanks for having summarized your solution. > > > > Cheers, > > Paolo > > > > On Tue, Feb 04, 2014 at 12:14:46AM +0100, Joan wrote: > > > #- Compile pf_ring > > > cd kernel; make install > > > cd ../userland/lib; make install > > > #We need also libpcap > > > cd userland/libpcap-1.1.1-ring/ > > > make install > > > > > > #Load the kernel module on boot > > > echo pf_ring >> /etc/modules > > > > > > #To compile pmacct with support for pf_ring > > > ./configure --with-pcap-libs=/usr/local/lib/ --prefix=/usr --enable-mmap > > > --enable-ipv6 --enable-threads > > > make > > > make install > > > > > > #After this we have pmacctd compiled, but there is on library that can't > > be > > > found > > > > > > linux-gate.so.1 => (0xb778f000) > > > libpcap.so.1 => not found > > > libpfring.so => /usr/local/lib/libpfring.so (0xb775f000) > > > libdl.so.2 => /lib/i386-linux-gnu/i686/cmov/libdl.so.2 (0xb775a000) > > > libpthread.so.0 => /lib/i386-linux-gnu/i686/cmov/libpthread.so.0 > > > (0xb7741000) > > > libc.so.6 => /lib/i386-linux-gnu/i686/cmov/libc.so.6 (0xb75de000) > > > /lib/ld-linux.so.2 (0xb7790000) > > > > > > > > > In my case I fixed it like this: > > > cd /usr/lib > > > ln -s /usr/local/lib/libpcap.so.1 libpcap.so.1 > > > > > > Once that was done, pmacct could start, and the performance is really > > much > > > better, I'd say about a 30% less load in the system. > > > I'll report any other findings I do, > > > > > > Thanks for your work again, > > > > > > Joan > > > > > > > > > 2014-02-03 Paolo Lucente <[email protected]>: > > > > > > > Hi Joan, > > > > > > > > I did not look at PF_RING recently but the steps you outline > > > > are those that make sense to me. Can you say what is precisely > > > > not working linking pmacct against PF_RING libpcap? Feel free > > > > to send me some output here or (maybe preferrably) privately, > > > > then we summarize outcome here. > > > > > > > > Cheers, > > > > Paolo > > > > > > > > On Mon, Feb 03, 2014 at 09:49:22AM +0100, Joan wrote: > > > > > Good morning, > > > > > > > > > > I am trying to use pmacct together with pf_ring to solve some > > performance > > > > > issues we are having, but I'm a bit lost about how to proceed. Can > > anyone > > > > > correct me if I'm wrong? > > > > > > > > > > - Download pf_ring module, compile and load into the system > > > > > - Recompile pmacct using pf_ring's libpcap instead of the system one > > > > (which > > > > > isn't ready) > > > > > > > > > > This last part is what doesn't work for me so far, any help would be > > > > > appreciated, > > > > > > > > > > Joan > > > > > > > > > _______________________________________________ > > > > > pmacct-discussion mailing list > > > > > http://www.pmacct.net/#mailinglists > > > > > > > > > > > > _______________________________________________ > > > > pmacct-discussion mailing list > > > > http://www.pmacct.net/#mailinglists > > > > > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
