Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cache time #8

Closed
wants to merge 4 commits into from
Closed

Cache time #8

wants to merge 4 commits into from

Commits on Aug 20, 2013

  1. Merge multiple copies of CreateTimeString() to one copy.

    There were 8 identical copies of CreateTimeString() in 8 files.
    Most used SCLocalTime, to replace localtime_r(), but some did not.
    Created one copy in util-time.c.
    ken-tilera committed Aug 20, 2013
    Configuration menu
    Copy the full SHA
    9d70ef9 View commit details
    Browse the repository at this point in the history

Commits on Aug 26, 2013

  1. Merge pull request OISF#6 from ken-tilera/mutex-init

    Mutex init
    regit committed Aug 26, 2013
    Configuration menu
    Copy the full SHA
    8c062a8 View commit details
    Browse the repository at this point in the history
  2. Merge pull request OISF#7 from ken-tilera/create-time

    Create time
    regit committed Aug 26, 2013
    Configuration menu
    Copy the full SHA
    faf242f View commit details
    Browse the repository at this point in the history
  3. Cache time conversions for localtime() and CreateTimeString()

    When converting a time in seconds (64-bit seconds since 1970) to
    Month/Day/Year hours minutes, Suricata calls localtime_r(), which
    always aquires a lock and then does complex comutation based on the
    current time zone. The time zone can be specified in the TZ
    environment variable, which is only parsed the first time it is used,
    or from a file. The default file is /etc/localtime. The file is
    checked each time to see if it might have changed and is reparsed if
    it has changed.
    
    The GLIBC library has a lock inside localtime_r(), which limits
    parallelism, which is a problem when the rate of generating alerts is
    high, since Suricata generates a new ascii time string for each alert
    into fast.log.
    
    This change caches the value returned by localtime_t() and then sets
    the seconds within the minute based on the cached start-of-minute
    time. All of the values return, expect for the seconds, is constant
    within the same minute. Switching to a new seconds could change all
    the other values, year, month, day, hour. The cache stores the current
    and previous minute values.
    
    The same trick is used in CreateTimeString() for generated time
    string. The string, up to the minutes, is cached and then copied into
    the result string, followed by printing the new seconds into the
    result string.
    
    The seconds within a minute are calculated as the difference in
    seconds from the start of the current minute.
    ken-tilera committed Aug 26, 2013
    Configuration menu
    Copy the full SHA
    a6ca702 View commit details
    Browse the repository at this point in the history