* David S. Miller wrote:
> It's spending nearly half of it's time in iptables.
> Try to consolidate your rules if possible. This is the
> part of netfilter that really doesn't scale well at all.
>
Removing the iptables rules helps reducing the load a little, but the
majority of time is still spent somewhere else.
50kpps rx and 43kpps tx.
procs -----------memory---------- ---swap-- -----io---- --system-- ----cpu----
r b swpd free buff cache si so bi bo in cs us sy id wa
0 0 0 1802956 101032 104464 0 0 0 18 74 26 0 21 79 0
0 0 0 1802956 101032 104464 0 0 0 61 8810 28 0 25 75 0
0 0 0 1802956 101032 104464 0 0 0 233 8867 17 0 24 76 0
0 0 0 1802892 101032 104464 0 0 0 0 8865 16 0 21 79 0
0 0 0 1802892 101032 104464 0 0 0 0 8772 8 0 18 82 0
<- iptables -F
0 0 0 1802892 101032 104464 0 0 0 36 8863 18 0 19 81 0
0 0 0 1802892 101032 104464 0 0 0 80 8700 18 0 18 82 0
0 0 0 1802956 101032 104464 0 0 0 0 8779 7 0 17 83 0
0 0 0 1802948 101032 104464 0 0 0 223 8716 278 4 19 76 0
- Karsten
|