suricata
runmode-erf-file.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "suricata-common.h"
19 #include "tm-threads.h"
20 #include "conf.h"
21 #include "runmodes.h"
22 #include "runmode-erf-file.h"
23 #include "output.h"
24 
25 #include "detect-engine.h"
26 
27 #include "util-debug.h"
28 #include "util-time.h"
29 #include "util-cpu.h"
30 #include "util-affinity.h"
31 
32 #include "util-runmodes.h"
33 
34 static const char *default_mode;
35 
37 {
38  return default_mode;
39 }
40 
42 {
43  default_mode = "autofp";
44 
46  "Single threaded ERF file mode",
48 
50  "Multi threaded ERF file mode. Packets from "
51  "each flow are assigned to a single detect thread",
53 
54  return;
55 }
56 
58 {
59  const char *file;
60 
61  SCEnter();
62 
63  if (ConfGet("erf-file.file", &file) == 0) {
64  SCLogError(SC_ERR_RUNMODE, "Failed to get erf-file.file from config.");
65  exit(EXIT_FAILURE);
66  }
67 
69 
71 
72  /* Basically the same setup as PCAP files. */
73 
75  "packetpool", "packetpool",
76  "packetpool", "packetpool",
77  "pktacqloop");
78  if (tv == NULL) {
79  printf("ERROR: TmThreadsCreate failed\n");
80  exit(EXIT_FAILURE);
81  }
82 
83  TmModule *tm_module = TmModuleGetByName("ReceiveErfFile");
84  if (tm_module == NULL) {
85  printf("ERROR: TmModuleGetByName failed for ReceiveErfFile\n");
86  exit(EXIT_FAILURE);
87  }
88  TmSlotSetFuncAppend(tv, tm_module, file);
89 
90  tm_module = TmModuleGetByName("DecodeErfFile");
91  if (tm_module == NULL) {
92  printf("ERROR: TmModuleGetByName DecodeErfFile failed\n");
93  exit(EXIT_FAILURE);
94  }
95  TmSlotSetFuncAppend(tv, tm_module, NULL);
96 
97  tm_module = TmModuleGetByName("FlowWorker");
98  if (tm_module == NULL) {
99  SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName for FlowWorker failed");
100  exit(EXIT_FAILURE);
101  }
102  TmSlotSetFuncAppend(tv, tm_module, NULL);
103 
104  if (TmThreadSpawn(tv) != TM_ECODE_OK) {
105  printf("ERROR: TmThreadSpawn failed\n");
106  exit(EXIT_FAILURE);
107  }
108 
109  SCLogInfo("RunModeErfFileSingle initialised");
110 
111  SCReturnInt(0);
112 }
113 
115 {
116  SCEnter();
117  char tname[TM_THREAD_NAME_MAX];
118  char qname[TM_QUEUE_NAME_MAX];
119  uint16_t cpu = 0;
120  char *queues = NULL;
121  uint16_t thread;
122 
124 
125  const char *file = NULL;
126  if (ConfGet("erf-file.file", &file) == 0) {
128  "Failed retrieving erf-file.file from config");
129  exit(EXIT_FAILURE);
130  }
131 
133 
134  /* Available cpus */
135  uint16_t ncpus = UtilCpuGetNumProcessorsOnline();
136 
137  /* start with cpu 1 so that if we're creating an odd number of detect
138  * threads we're not creating the most on CPU0. */
139  if (ncpus > 0)
140  cpu = 1;
141 
142  /* always create at least one thread */
143  int thread_max = TmThreadGetNbThreads(WORKER_CPU_SET);
144  if (thread_max == 0)
145  thread_max = ncpus * threading_detect_ratio;
146  if (thread_max < 1)
147  thread_max = 1;
148  if (thread_max > 1024)
149  thread_max = 1024;
150 
151  queues = RunmodeAutoFpCreatePickupQueuesString(thread_max);
152  if (queues == NULL) {
153  SCLogError(SC_ERR_RUNMODE, "RunmodeAutoFpCreatePickupQueuesString failed");
154  exit(EXIT_FAILURE);
155  }
156 
157  /* create the threads */
158  ThreadVars *tv =
160  "packetpool", "packetpool",
161  queues, "flow",
162  "pktacqloop");
163  SCFree(queues);
164 
165  if (tv == NULL) {
166  printf("ERROR: TmThreadsCreate failed\n");
167  exit(EXIT_FAILURE);
168  }
169  TmModule *tm_module = TmModuleGetByName("ReceiveErfFile");
170  if (tm_module == NULL) {
171  printf("ERROR: TmModuleGetByName failed for ReceiveErfFile\n");
172  exit(EXIT_FAILURE);
173  }
174  TmSlotSetFuncAppend(tv, tm_module, file);
175 
176  tm_module = TmModuleGetByName("DecodeErfFile");
177  if (tm_module == NULL) {
178  printf("ERROR: TmModuleGetByName DecodeErfFile failed\n");
179  exit(EXIT_FAILURE);
180  }
181  TmSlotSetFuncAppend(tv, tm_module, NULL);
182 
184  TmThreadSetCPUAffinity(tv, 0);
185  if (ncpus > 1)
187  }
188 
189  if (TmThreadSpawn(tv) != TM_ECODE_OK) {
190  printf("ERROR: TmThreadSpawn failed\n");
191  exit(EXIT_FAILURE);
192  }
193 
194  for (thread = 0; thread < (uint16_t)thread_max; thread++) {
195  snprintf(tname, sizeof(tname), "%s#%02u", thread_name_workers, thread+1);
196  snprintf(qname, sizeof(qname), "pickup%u", thread+1);
197 
198  SCLogDebug("tname %s, qname %s", tname, qname);
199 
200  SCLogDebug("Assigning %s affinity to cpu %u", tname, cpu);
201 
202  ThreadVars *tv_detect_ncpu =
204  qname, "flow",
205  "packetpool", "packetpool",
206  "varslot");
207  if (tv_detect_ncpu == NULL) {
208  printf("ERROR: TmThreadsCreate failed\n");
209  exit(EXIT_FAILURE);
210  }
211 
212  tm_module = TmModuleGetByName("FlowWorker");
213  if (tm_module == NULL) {
214  SCLogError(SC_ERR_RUNMODE, "TmModuleGetByName for FlowWorker failed");
215  exit(EXIT_FAILURE);
216  }
217  TmSlotSetFuncAppend(tv_detect_ncpu, tm_module, NULL);
218 
220  TmThreadSetCPUAffinity(tv_detect_ncpu, (int)cpu);
221  /* If we have more than one core/cpu, the first Detect thread
222  * (at cpu 0) will have less priority (higher 'nice' value)
223  * In this case we will set the thread priority to +10 (default is 0)
224  */
225  if (cpu == 0 && ncpus > 1) {
226  TmThreadSetThreadPriority(tv_detect_ncpu, PRIO_LOW);
227  } else if (ncpus > 1) {
228  TmThreadSetThreadPriority(tv_detect_ncpu, PRIO_MEDIUM);
229  }
230  }
231 
232  TmThreadSetGroupName(tv_detect_ncpu, "Detect");
233 
234  if (TmThreadSpawn(tv_detect_ncpu) != TM_ECODE_OK) {
235  printf("ERROR: TmThreadSpawn failed\n");
236  exit(EXIT_FAILURE);
237  }
238 
239  if ((cpu + 1) == ncpus)
240  cpu = 0;
241  else
242  cpu++;
243  }
244 
245  SCLogInfo("RunModeErfFileAutoFp initialised");
246 
247  SCReturnInt(0);
248 }
void TmSlotSetFuncAppend(ThreadVars *tv, TmModule *tm, const void *data)
Appends a new entry to the slots.
Definition: tm-threads.c:816
#define SCLogDebug(...)
Definition: util-debug.h:335
float threading_detect_ratio
Definition: runmodes.c:920
int TmThreadGetNbThreads(uint8_t type)
Definition: tm-threads.c:1029
int RunModeErfFileAutoFp(void)
void RunModeInitialize(void)
Definition: runmodes.c:925
const char * RunModeErfFileGetDefaultMode(void)
void RunModeRegisterNewRunMode(int runmode, const char *name, const char *description, int(*RunModeFunc)(void))
Registers a new runmode.
Definition: runmodes.c:421
TmEcode TmThreadSetThreadPriority(ThreadVars *tv, int prio)
Set the thread options (thread priority).
Definition: tm-threads.c:957
const char * thread_name_single
Definition: runmodes.c:62
ThreadVars * TmThreadCreatePacketHandler(const char *name, const char *inq_name, const char *inqh_name, const char *outq_name, const char *outqh_name, const char *slots)
Creates and returns a TV instance for a Packet Processing Thread. This function doesn&#39;t support custo...
Definition: tm-threads.c:1225
void TmThreadSetGroupName(ThreadVars *tv, const char *name)
Definition: tm-threads.c:1812
void TimeModeSetOffline(void)
Definition: util-time.c:88
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:331
int RunModeErfFileSingle(void)
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
char * RunmodeAutoFpCreatePickupQueuesString(int n)
create a queue string for autofp to pass to the flow queue handler.
Definition: util-runmodes.c:59
#define SCEnter(...)
Definition: util-debug.h:337
#define SCReturnInt(x)
Definition: util-debug.h:341
#define TM_QUEUE_NAME_MAX
Definition: tm-threads.h:47
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:254
#define SCFree(a)
Definition: util-mem.h:228
const char * thread_name_autofp
Definition: runmodes.c:61
#define TM_THREAD_NAME_MAX
Definition: tm-threads.h:48
TmEcode TmThreadSetCPUAffinity(ThreadVars *tv, uint16_t cpu)
Set the thread options (cpu affinity).
Definition: tm-threads.c:1004
TmModule * TmModuleGetByName(const char *name)
get a tm module ptr by name
Definition: tm-modules.c:51
Per thread variable structure.
Definition: threadvars.h:57
void RunModeErfFileRegister(void)
uint16_t UtilCpuGetNumProcessorsOnline(void)
Get the number of cpus online in the system.
Definition: util-cpu.c:99
int threading_set_cpu_affinity
Definition: runmodes.h:112
TmEcode TmThreadSpawn(ThreadVars *tv)
Spawns a thread associated with the ThreadVars instance tv.
Definition: tm-threads.c:1855
const char * thread_name_workers
Definition: runmodes.c:63