diff options
Diffstat (limited to 'doc/userguide/rule-management/rule-profiling.rst')
| -rw-r--r-- | doc/userguide/rule-management/rule-profiling.rst | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/doc/userguide/rule-management/rule-profiling.rst b/doc/userguide/rule-management/rule-profiling.rst new file mode 100644 index 0000000..2c99260 --- /dev/null +++ b/doc/userguide/rule-management/rule-profiling.rst @@ -0,0 +1,28 @@ +Rules Profiling +=============== + +If Suricata is built with the `--enable-profiling-rules` then the ruleset profiling +can be activated on demand from the unix socket and dumped from it. + +To start profiling :: + + suricatasc -c ruleset-profile-start + +To stop profiling :: + + suricatasc -c ruleset-profile-stop + +To dump profiling :: + + suricatasc -c ruleset-profile + +A typical scenario to get rules performance would be :: + + suricatasc -c ruleset-profile-start + sleep 30 + suricatasc -c ruleset-profile-stop + suricatasc -c ruleset-profile + +On busy systems, using the sampling capability to capture performance +on a subset of packets can be obtained via the `sample-rate` variable +in the `profiling` section in the `suricata.yaml` file. |