packetbeats
Joined 14 years ago
Karma
398
Submissions
35
Member since
Dec 4
http://packetbeat.com
View on Hacker NewsRecent submissions
Comment · 3 years ago
I was thinking of it as the starting point, then you evolve from there.
Tbh, views are a bit of a leaky abstraction (for example when it comes to constraints) so adopting them gradually seems like a good idea.
Comment · 11 years ago
You can see a live demo of Kibana here: http://demo.elastic.co/packetbeat/
Comment · 12 years ago
Many thanks for posting it! :)
Comment · 12 years ago
It will drop traffic in that case.
Comment · 12 years ago
PF_RING is an option but it requires a kernel module and specific network cards. Before then, the memory map sniffing feature of the Linux kernel [1] can improve libpcap performance. Not quite to 10G speeds, though, but I think enough for most cases :-)
[1]: http://www.cs.fsu.edu/~baker/devices/lxr/http/source/linux/D...
Comment · 12 years ago
Depending on the traffic, the CPU usage of the agent could indeed be significant. We're thinking to implement sampling to reduce the effect of this. On the other hand, the agent is not "in-line" so it cannot introduce any latency, only steal CPU time from them.
So, unless you have a single CPU core, it's pretty safe to run in production. It cannot affect the application performance by much.
Thanks for noticing the broken link, we fixed it.