Commits on Aug 27, 2013

1. Cache time conversions for localtime() and CreateTimeString() …

   When converting a time in seconds (64-bit seconds since 1970) to
   Month/Day/Year hours minutes, Suricata calls localtime_r(), which
   always aquires a lock and then does complex comutation based on the
   current time zone. The time zone can be specified in the TZ
   environment variable, which is only parsed the first time it is used,
   or from a file. The default file is /etc/localtime. The file is
   checked each time to see if it might have changed and is reparsed if
   it has changed.
   
   The GLIBC library has a lock inside localtime_r(), which limits
   parallelism, which is a problem when the rate of generating alerts is
   high, since Suricata generates a new ascii time string for each alert
   into fast.log.
   
   This change caches the value returned by localtime_t() and then sets
   the seconds within the minute based on the cached start-of-minute
   time. All of the values return, expect for the seconds, is constant
   within the same minute. Switching to a new seconds could change all
   the other values, year, month, day, hour. The cache stores the current
   and previous minute values.
   
   The same trick is used in CreateTimeString() for generated time
   string. The string, up to the minutes, is cached and then copied into
   the result string, followed by printing the new seconds into the
   result string.
   
   The seconds within a minute are calculated as the difference in
   seconds from the start of the current minute.

   

   ken-tilera committed Aug 27, 2013
   Configuration menu

   • View commit details
   • Copy full SHA for e3764c2
   • Browse repository at this point

   Copy the full SHA

   e3764c2 View commit details

   Browse the repository at this point in the history