35-40% performance drop releng9 vs releng10 openvpn

[Mike Tancsa]

On 3/18/2015 5:14 PM, John-Mark Gurney wrote:
>
> So, I would first identify the machine w/ the cpu limited load.. I
> assume that is apu...

Yup, the APU.  The machines on either side are significantly faster


> Then I would look at where most of the cpu time
> is being spent, be it openvpn itself, or in the kernel... Most likely
> it is the kernel, so getting stacks from the kernel would be more useful
> than the one you generated...  Use the command:
> # dtrace -x stackframes=100 -n 'profile-997 /arg0/ { @[stack()] = count(); } tick-60s { exit(0); }' -o out.kern_stacks
>
> Also, another thing you can do is to compare the two using differential
> flame graphs:
> http://www.brendangregg.com/blog/2014-11-09/differential-flame-graphs.html
>
> Which will highlight where the performances differ...
>

Will do, I will work on those.


> As I've never used OpenVPN before and their docs don't go into saying
> what it's using.. Is OpenVPN a kernel or userland VPN?  Do they use
> IPSec in the kernel? or are they just using UDP or TCP for their
> connections?


All in userland.  I use UDP for the transport, and it uses OpenSSL in 
the base for the crypto.  In this case, AES-128-CBC.  There is no 
hardware assist on the APU either to offload the AES.

	---Mike

-- 
-------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike at sentex.net
Providing Internet services since 1994 www.sentex.net
Cambridge, Ontario Canada   http://www.tancsa.com/