mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
0282a4fd81
The per-thread threshold decision cache (limit/both thresholds tracked by_src/by_dst, IPv4) grew without bound: every distinct tracked address allocated an item plus a hash-table bucket, while housekeeping reclaims at most two entries per whole second. Address this by: Cap the cache at detect.thresholds.cache.max-entries entries per thread (default 256; valid range 256-1048576, out-of-range values fail startup); on overflow evict the entry with the earliest expiry before inserting Account cache memory in the new detect.thresholds.cache.memuse counter: each entry (item plus bucket node) is charged on insert and released on eviction, expiry and on thread teardown, and the fixed per-thread charge (thread context, hash table struct and the eagerly allocated bucket pointer array) is charged at cache init and released symmetrically on teardown, so the gauge reflects the cache memory in use and does not accumulate stale charges when threads are recreated, e.g. unix-socket PCAP file jobs Size the cache hash table to the entry cap (next power of two, minimum 256) at thread init so lookups stay O(1) up to the cap. Fail startup when the threshold table cannot be initialized, instead of continuing with a NULL table. Ticket: #8956. |
2 months ago | |
|---|---|---|
| .. | ||
| Makefile.am | 2 years ago | |
| classification.config | 6 years ago | |
| reference.config | 2 years ago | |
| schema.json | 2 months ago | |
| suricata.logrotate.in | 6 years ago | |
| suricata.service.in | 9 years ago | |