{"action":"created","issue":{"url":"https://api.github.com/repos/stamparm/maltrail/issues/63","repository_url":"https://api.github.com/repos/stamparm/maltrail","labels_url":"https://api.github.com/repos/stamparm/maltrail/issues/63/labels{/name}","comments_url":"https://api.github.com/repos/stamparm/maltrail/issues/63/comments","events_url":"https://api.github.com/repos/stamparm/maltrail/issues/63/events","html_url":"https://github.com/stamparm/maltrail/issues/63","id":132536326,"number":63,"title":"FeatReq: Selectable number of packet processing cores","user":{"login":"petiepooo","id":1916012,"avatar_url":"https://avatars.githubusercontent.com/u/1916012?v=3","gravatar_id":"","url":"https://api.github.com/users/petiepooo","html_url":"https://github.com/petiepooo","followers_url":"https://api.github.com/users/petiepooo/followers","following_url":"https://api.github.com/users/petiepooo/following{/other_user}","gists_url":"https://api.github.com/users/petiepooo/gists{/gist_id}","starred_url":"https://api.github.com/users/petiepooo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/petiepooo/subscriptions","organizations_url":"https://api.github.com/users/petiepooo/orgs","repos_url":"https://api.github.com/users/petiepooo/repos","events_url":"https://api.github.com/users/petiepooo/events{/privacy}","received_events_url":"https://api.github.com/users/petiepooo/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/stamparm/maltrail/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":{"login":"stamparm","id":921555,"avatar_url":"https://avatars.githubusercontent.com/u/921555?v=3","gravatar_id":"","url":"https://api.github.com/users/stamparm","html_url":"https://github.com/stamparm","followers_url":"https://api.github.com/users/stamparm/followers","following_url":"https://api.github.com/users/stamparm/following{/other_user}","gists_url":"https://api.github.com/users/stamparm/gists{/gist_id}","starred_url":"https://api.github.com/users/stamparm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stamparm/subscriptions","organizations_url":"https://api.github.com/users/stamparm/orgs","repos_url":"https://api.github.com/users/stamparm/repos","events_url":"https://api.github.com/users/stamparm/events{/privacy}","received_events_url":"https://api.github.com/users/stamparm/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2016-02-09T21:16:38Z","updated_at":"2016-02-10T11:13:06Z","closed_at":null,"body":"I can see this running on a multi-use sensor with other NSM tools, such as netsniff-ng, snort, etc.  When USE_MULTIPROCESSING is set to true, defaulting the number of packet processing cores to cpu_count - 1 is unfriendly in this regard.\r\n\r\nI'd love to see the ability to select the number of CPU processes created for processing packets.  Say a configuration option that's used instead of _multiprocessing.cpu_count() within the _init_multiprocessing() function.  If the config option is unspecified, it could default to cpu_count() - 1.\r\n\r\nI'd recommend not setting affinity either if a process count is specified.\r\n\r\nThis would also lend itself to use on specific interfaces by running with different config files."},"comment":{"url":"https://api.github.com/repos/stamparm/maltrail/issues/comments/182320473","html_url":"https://github.com/stamparm/maltrail/issues/63#issuecomment-182320473","issue_url":"https://api.github.com/repos/stamparm/maltrail/issues/63","id":182320473,"user":{"login":"petiepooo","id":1916012,"avatar_url":"https://avatars.githubusercontent.com/u/1916012?v=3","gravatar_id":"","url":"https://api.github.com/users/petiepooo","html_url":"https://github.com/petiepooo","followers_url":"https://api.github.com/users/petiepooo/followers","following_url":"https://api.github.com/users/petiepooo/following{/other_user}","gists_url":"https://api.github.com/users/petiepooo/gists{/gist_id}","starred_url":"https://api.github.com/users/petiepooo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/petiepooo/subscriptions","organizations_url":"https://api.github.com/users/petiepooo/orgs","repos_url":"https://api.github.com/users/petiepooo/repos","events_url":"https://api.github.com/users/petiepooo/events{/privacy}","received_events_url":"https://api.github.com/users/petiepooo/received_events","type":"User","site_admin":false},"created_at":"2016-02-10T11:13:06Z","updated_at":"2016-02-10T11:13:06Z","body":"If I run two instances of this using two config files, each with a different eth interface, will they have affinity set to use the same CPUs?  \r\n\r\nI typically run things like this on a 24 or 32-core server and let the scheduled do its thing shuffling the task between cores.\r\n\r\nIf affinity does come into play, I prefer setting it such that hyperthread cores are excluded and data from the sniffing process going to processing processes never have to leave the physical CPU's cache on a dual socket server. That level of config is very machine-dependent and is best done explicitly or manually. "}}