Re: [PATCH nf-next] netfilter: conntrack: allow to tune gc behavior

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> Hi,
> 
> On Sun, Nov 21, 2021 at 06:05:14PM +0100, Florian Westphal wrote:
> > as of commit 4608fdfc07e1
> > ("netfilter: conntrack: collect all entries in one cycle")
> > conntrack gc was changed to run periodically every 2 minutes.
> > 
> > On systems where conntrack hash table is set to large value,
> > almost all evictions happen from gc worker rather than the packet
> > path due to hash table distribution.
> > 
> > This causes netlink event overflows when the events are collected.
> 
> If the issue is netlink, it should be possible to batch netlink
> events.

I do not see how.

> > 1. gc interval (milliseconds, default: 2 minutes)
> > 2. buckets per cycle (default: UINT_MAX / all)
> > 
> > This allows to increase the scan intervals but also to reduce bustiness
> > by switching to partial scans of the table for each cycle.
> 
> Is there a way to apply autotuning? I know, this question might be
> hard, but when does the user has update this new toggle?

Whenever you need to timely delivery of events, or you need timely
reaping of outdated entries.

And we can't increase scan frequency because that will cause
more wakeups on otherwise idle systems, that was the entire reason
for going with 2m.

> And do we
> know what value should be placed here?

I tried, did not work out (see history of gc worker).

Only alternative i see is to give up and revert back to
per ct-timers.