Adding upstream version 1:7.0.3.upstream/1%7.0.3

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 28 insertions, 0 deletions

diff --git a/doc/userguide/rule-management/rule-profiling.rst b/doc/userguide/rule-management/rule-profiling.rst
new file mode 100644
index 0000000..2c99260
--- /dev/null
+++ b/doc/userguide/rule-management/rule-profiling.rst
@@ -0,0 +1,28 @@
+Rules Profiling
+===============
+
+If Suricata is built with the `--enable-profiling-rules` then the ruleset profiling
+can be activated on demand from the unix socket and dumped from it.
+
+To start profiling ::
+
+ suricatasc -c ruleset-profile-start
+
+To stop profiling ::
+
+ suricatasc -c ruleset-profile-stop
+
+To dump profiling ::
+
+ suricatasc -c ruleset-profile
+
+A typical scenario to get rules performance would be ::
+
+ suricatasc -c ruleset-profile-start
+ sleep 30
+ suricatasc -c ruleset-profile-stop
+ suricatasc -c ruleset-profile
+
+On busy systems, using the sampling capability to capture performance
+on a subset of packets can be obtained via the `sample-rate` variable
+in the `profiling` section in the `suricata.yaml` file.