From nobody Wed May 27 14:23:36 2026 X-Original-To: ports-bugs@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gQX0m0xFVz6f6jj for ; Wed, 27 May 2026 14:23:36 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gQX0m0NT8z3CYL for ; Wed, 27 May 2026 14:23:36 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779891816; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HByEVB+eYs041D07cB1bwVkGpAKWAw6cUJjKF9pJrVs=; b=YcAHPoGDGOiXeSBGTfkE9PjRwwgn1Q8YYVxGUBaQSfnjyNH4Ytqp4BrBsZtl+2QNPCG+/T PXTgVlv0dhrnolu7VMZqv+lMFAkIxeltM3nsBroRigOR5R3DMHynGgRevrl1uJEMKDnyBR jYxlXxBZedM/bra5uOPMQfCMKaD/q9oQ+mUza+ZcKy21xWF9xfrETvkaKPC+8sz5fti2ph b6VR9l7MMOGcHAEZ/IAyx1UZMcCZZ+Rnz3PmJ/SD5V0uLfDMq1zxH9IVXPEM6V+9eIi6DO TQiaddGPH4buEno8h5YLYmABf4sR06HAnTARQOvOfCDjPWNwg3UY7LoULAUajg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1779891816; a=rsa-sha256; cv=none; b=d1WcZKCq4h18aq2ipN6Lyv4HXipaK/4j+NrAfvwMNiQA5G0lMFqK3yp5VFVftY+Fdp3Dq2 vrj8oO9ItgwmOLfzpy/hK7LpsksijYnd3BQUUwLbNGouEWROz2AfJK4J0o7rVekmG/gp/J qH3EH/Gn+PBJSfSVbpLwjPnYjc8XPXvWLrJ0clqdWW8Eg7RZkHokUs5PK3LemvaKMFOC4j JGY/lsuDZqkdQyP55a99a+hG420JpzMSPC0bchke+IhSiboa3saT5IJMasdOkXacUrCrne ejOdwMmY4eLE0UtvlIUDfT6IawgAZyhEcjFsAUov98LFZmAdqJrNr3N/IqH/gA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779891816; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HByEVB+eYs041D07cB1bwVkGpAKWAw6cUJjKF9pJrVs=; b=wzs0p5JnWeLlImaiBLCrkJkRkfB3bZ4tlCNofUPFhfbJDN6ca/cHp8tIrSoW2SLF5HV/fl 9KXMUqGewy5GUrOS2VFq5aVV27sXYtuFWqGBeARwUuF1c8HzFHgCHCPelQ1roIYaQRbEGW vPgoBqH0Ozgk3ACRYUZbtxhaUT3YdhE6h0Q/obScAdLNs77EQzbSGOi2xwEOFGuqiRVTRE QKJM0amAlgXewjtfxEEoe8RX+gVC5P/5Fo6tIBsH1iSmNi81dtX/Nxkma3aWPMOaP+1iq8 YIh7FxLGCN8zi6WK9OfXT4GeMw2XwWL94CoUZVl1rIASIqOnZjjTk90TLX0I9w== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4gQX0m00Swz13KX for ; Wed, 27 May 2026 14:23:36 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 64RENZGd078935 for ; Wed, 27 May 2026 14:23:35 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 64RENZ4a078934 for ports-bugs@FreeBSD.org; Wed, 27 May 2026 14:23:35 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: ports-bugs@FreeBSD.org Subject: [Bug 284377] security/suricata: fix suricata-update baked in paths to JustWork on FreeBSD Date: Wed, 27 May 2026 14:23:36 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Ports & Packages X-Bugzilla-Component: Individual Port(s) X-Bugzilla-Version: Latest X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Many People X-Bugzilla-Who: yds@Necessitu.de X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: ports-bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: attachments.isobsolete attachments.created Message-ID: In-Reply-To: References: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Ports bug reports List-Archive: https://lists.freebsd.org/archives/freebsd-ports-bugs List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-ports-bugs@freebsd.org Sender: owner-freebsd-ports-bugs@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D284377 yds changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #270963|0 |1 is obsolete| | --- Comment #7 from yds --- Created attachment 271253 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D271253&action= =3Dedit fix suricata-update baked in paths to JustWork on FreeBSD patch updated to apply clean on top of the current 8.0.5 port. this patch adds `@dir /var/cache/suricata/sgh` to pkg-plist and configures = the pkg to use the path by default in `suricata.yaml.sample`: ``` detect: sgh-mpm-context: auto sgh-mpm-caching: yes sgh-mpm-caching-path: /var/cache/suricata/sgh ``` getting this setting right made a night-and day difference when rebooting w= ith suricata enabled. /without/ sgh-mpm-caching-path properly configured suricata re-compiles all= the HyperScan filters every time suricata is restarted which can take more than= 15 minutes on a 8-core Xeon at 100% CPU usage. /after/ setting `sgh-mpm-caching-path: /var/cache/suricata/sgh` there's no = 100% CPU usage spike when launching suricata. now the CPU spike happens only du= ring the nightly suricata-update cronjob run and there's no need for suricata to recompile anything every single time after a restart. FWIW, I set my suricata-update cronjob to run about 30 minutes after midnig= ht -- seems like a quiet enough time when the CPU is not being tasked with any other chores. based on the timestamps in /var/cache/suricata/sgh/ suricata= is typically done compiling the updated HyperScan filters by 45 minutes after midnight. --=20 You are receiving this mail because: You are the assignee for the bug.=