Skip to content

Commit

Permalink
profiling: add option to active rules profiling at start
Browse files Browse the repository at this point in the history
When replaying a pcap file, it is not possible to get rules
profiling because it has to be activated from the unix socket.
This patch adds a new option to be able to activate profiling
collection at start so a pcap run can get rules profiling
information.
  • Loading branch information
regit authored and victorjulien committed Jun 15, 2024
1 parent bd96087 commit eecb344
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 0 deletions.
6 changes: 6 additions & 0 deletions src/util-profiling.c
Original file line number Diff line number Diff line change
Expand Up @@ -1432,6 +1432,7 @@ void SCProfilingInit(void)
SC_ATOMIC_INIT(profiling_rules_active);
SC_ATOMIC_INIT(samples);
intmax_t rate_v = 0;
ConfNode *conf;

(void)ConfGetInt("profiling.sample-rate", &rate_v);
if (rate_v > 0 && rate_v < INT_MAX) {
Expand All @@ -1448,6 +1449,11 @@ void SCProfilingInit(void)
else
SCLogInfo("profiling runs for every packet");
}

conf = ConfGetNode("profiling.rules");
if (ConfNodeChildValueIsTrue(conf, "active")) {
SC_ATOMIC_SET(profiling_rules_active, 1);
}
}

/* see if we want to profile rules for this packet */
Expand Down
4 changes: 4 additions & 0 deletions suricata.yaml.in
Original file line number Diff line number Diff line change
Expand Up @@ -1810,6 +1810,10 @@ profiling:
enabled: yes
filename: rule_perf.log
append: yes
# Set active to yes to enable rules profiling at start
# if set to no (default), the rules profiling will have to be started
# via unix socket commands.
#active:no

# Sort options: ticks, avgticks, checks, matches, maxticks
# If commented out all the sort options will be used.
Expand Down

0 comments on commit eecb344

Please sign in to comment.