Replies: 7 comments
-
Indeed, looking at
After patching SegmentProfiler to not initialize
I'll add that to #3483. Whether or not to keep SegmentProfiler at all would still be good to discuss. |
Beta Was this translation helpful? Give feedback.
-
+1 for removing it. I have no idea how to use SegmentProfiler and not sure if it's been used in decades. |
Beta Was this translation helpful? Give feedback.
-
@0xxon Didn't you have a prototype at one point of adding dtrace/bpftrace points to the code? |
Beta Was this translation helpful? Give feedback.
-
Looks like this is indeed quite dated, @rsmmr and Jon originally worked on it around 2010. It's controlled by the script layer — try running with
It's only very lightly used. I thought I spotted a recent instance in the packet analyzer framework but it looks like it just ended up there as part of migrating code. It doesn't seem as valuable as the other perf content. The ability to place the profiler into specific scopes is nice since it keeps potential workflows within Zeek as opposed to, say, perf. But I see no test cases for any of this, and it'd need modernizing. It's also little code overall, and there's virtually nothing in Without any objections I'll vote to remove it all outright. But first: @vpax I know that profiling is of great interest to you — this isn't what you're working with, is it? @rsmmr — any history lessons for this one? :-) |
Beta Was this translation helpful? Give feedback.
-
@ckreibich no, this isn't part of the profiling stuff of interest for me - thanks for checking! |
Beta Was this translation helpful? Give feedback.
-
Robin also confirms he doesn't use it, so it looks safe to discard. |
Beta Was this translation helpful? Give feedback.
-
It's been removed. |
Beta Was this translation helpful? Give feedback.
-
Running
zeek -r
against a pcap with 128 connections and ~29k orig and ~22k resp packetes and 20k raised events per connection for a simple and fast BinPac analyzer shows the SegmentProfiler constructor as the 4th hottest function.I wonder if SegmentProfiler these days has basically been replaced by "perf" or "instruments" or other tools and maybe we could just drop it? Also, if we need custom profiling within Zeek, maybe it would be nice to look into USDT - Userland Statically-Defined Tracing and add some at crucial points [1,2].
If we don't want to ditch it, maybe we can switch it to something more efficient similar to how Spicy's profiling does it, I suspect it's actually the 144bytes rusage initialized to
0
that are so expensive.[1] https://www.brendangregg.com/blog/2015-06-28/linux-ftrace-uprobe.html
[2] https://lwn.net/Articles/753601/
Link to pcap: https://github.com/awelzel/pcaps/blob/master/bench-traffic-128-10000.pcap.zst
Beta Was this translation helpful? Give feedback.
All reactions