Performance Optimization Guide

About

This guide is about performance optimization of the Allegro for specific use cases. By default, the Allegro runs in a configuration that fits for the majority of users and you do not need to change any parameter of the configuration.

High Level Allegro System Layout

The Allegro has various different units that can be optimized. These units are:

• I/O Threads: responsible for all packet I/O operations
• Analyzer Threads: responsible for decoding and most of the DB operations
• DB Threads: optional threads offloading memory intensive database operations, see DB mode
• Disk I/O

Please note that there are queues that buffer messages between all hardware instances ( Interface chips, central processing unit, storage ) and threads which can be tuned. The following queues can be monitored to see where you need to change settings in the Allegro:

Interface hardware queues

This first queue is between the interfaces and processing unit. Whenever the I/O threads are too slow to consume all packets from the built-in or extension interfaces, the hardware miss counter of the interface statistics will increase over time.

The load of the I/O threads can be checked at the Info → System Info → Load.

TODO: add overloaded Interface graph.

If this counter increases regularly, you can try the following settings:

• use sink mode instead of bridge mode, see below #Sink Mode
• increase the number of I/O threads: #More I/O Threads

Analyzer queue

The Allegro has a packet queue between I/O threads and the analyzer threads. Please note that the increasing counters at the initial startup of the Allegro can be normal under high load scenarios for a few seconds. There are 3 scenarios where the an queue overload can happen.

Low analyzer load and drop

This happens if the Allegro is in a powersafe mode and a sudden peak of traffic is monitored. The solution is to use the #Sink Mode and to activate the Analyzer queue overcommit at Settings → Global settings → Expert settings. This allows to buffer sudden network bursts.

High analyzer load

There are a few options for reducing the analyzer load but it always comes with the penalty of not processing all data. You can reduce the statistic level or add a NIC filter.

You can reduce the level of analysis at Settings -> Global Settings.

Every Level reduction will reduce the amount of analyzed data and saves database operations, see Global_settings#Limit_module_processing for more details of this mode. You can use this mode to store high packet rates into the ring buffer and re-analyze parts of it with full analytics with the Parallel packet processing.

The NIC filter can be used to reduce the amount of monitored traffic. It excludes traffic from the analyzers for the cost of not-seeing all traffic of the link. See the interface filter for more details.

Packet Drops in Queue

The Allegro Network Multimeter will inform you if a packet loss has been happened. The Allegro has certain hardware and software queues that can drop packet due overload.

Optimizations

Sink Mode

For configuration, please see: Global_settings#Packet_processing_mode

The bridge mode requires approximately 10 % more load on the I/O Threads as this threads have to sent the traffic to the corresponding network interface for forwarding. Allegro recommends to use