From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 24/53] netfilter: conntrack: remove packet hotpath stats
Date: Mon, 26 Sep 2016 01:06:34 +0200 [thread overview]
Message-ID: <1474844823-2026-25-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1474844823-2026-1-git-send-email-pablo@netfilter.org>
From: Florian Westphal <fw@strlen.de>
These counters sit in hot path and do show up in perf, this is especially
true for 'found' and 'searched' which get incremented for every packet
processed.
Information like
searched=212030105
new=623431
found=333613
delete=623327
does not seem too helpful nowadays:
- on busy systems found and searched will overflow every few hours
(these are 32bit integers), other more busy ones every few days.
- for debugging there are better methods, such as iptables' trace target,
the conntrack log sysctls. Nowadays we also have perf tool.
This removes packet path stat counters except those that
are expected to be 0 (or close to 0) on a normal system, e.g.
'insert_failed' (race happened) or 'invalid' (proto tracker rejects).
The insert stat is retained for the ctnetlink case.
The found stat is retained for the tuple-is-taken check when NAT has to
determine if it needs to pick a different source address.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/linux/netfilter/nf_conntrack_common.h | 4 ----
include/uapi/linux/netfilter/nfnetlink_conntrack.h | 8 ++++----
net/netfilter/nf_conntrack_core.c | 14 ++------------
net/netfilter/nf_conntrack_netlink.c | 6 +-----
net/netfilter/nf_conntrack_standalone.c | 8 ++++----
5 files changed, 11 insertions(+), 29 deletions(-)
diff --git a/include/linux/netfilter/nf_conntrack_common.h b/include/linux/netfilter/nf_conntrack_common.h
index 275505792664..1d1ef4e20512 100644
--- a/include/linux/netfilter/nf_conntrack_common.h
+++ b/include/linux/netfilter/nf_conntrack_common.h
@@ -4,13 +4,9 @@
#include <uapi/linux/netfilter/nf_conntrack_common.h>
struct ip_conntrack_stat {
- unsigned int searched;
unsigned int found;
- unsigned int new;
unsigned int invalid;
unsigned int ignore;
- unsigned int delete;
- unsigned int delete_list;
unsigned int insert;
unsigned int insert_failed;
unsigned int drop;
diff --git a/include/uapi/linux/netfilter/nfnetlink_conntrack.h b/include/uapi/linux/netfilter/nfnetlink_conntrack.h
index 9df789709abe..6deb8867c5fc 100644
--- a/include/uapi/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/uapi/linux/netfilter/nfnetlink_conntrack.h
@@ -231,13 +231,13 @@ enum ctattr_secctx {
enum ctattr_stats_cpu {
CTA_STATS_UNSPEC,
- CTA_STATS_SEARCHED,
+ CTA_STATS_SEARCHED, /* no longer used */
CTA_STATS_FOUND,
- CTA_STATS_NEW,
+ CTA_STATS_NEW, /* no longer used */
CTA_STATS_INVALID,
CTA_STATS_IGNORE,
- CTA_STATS_DELETE,
- CTA_STATS_DELETE_LIST,
+ CTA_STATS_DELETE, /* no longer used */
+ CTA_STATS_DELETE_LIST, /* no longer used */
CTA_STATS_INSERT,
CTA_STATS_INSERT_FAILED,
CTA_STATS_DROP,
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index ac1db4019d5c..8d1ddb9b63ed 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -379,7 +379,6 @@ static void
destroy_conntrack(struct nf_conntrack *nfct)
{
struct nf_conn *ct = (struct nf_conn *)nfct;
- struct net *net = nf_ct_net(ct);
struct nf_conntrack_l4proto *l4proto;
pr_debug("destroy_conntrack(%p)\n", ct);
@@ -406,7 +405,6 @@ destroy_conntrack(struct nf_conntrack *nfct)
nf_ct_del_from_dying_or_unconfirmed_list(ct);
- NF_CT_STAT_INC(net, delete);
local_bh_enable();
if (ct->master)
@@ -438,7 +436,6 @@ static void nf_ct_delete_from_lists(struct nf_conn *ct)
nf_ct_add_to_dying_list(ct);
- NF_CT_STAT_INC(net, delete_list);
local_bh_enable();
}
@@ -529,11 +526,8 @@ begin:
if (nf_ct_is_dying(ct))
continue;
- if (nf_ct_key_equal(h, tuple, zone, net)) {
- NF_CT_STAT_INC_ATOMIC(net, found);
+ if (nf_ct_key_equal(h, tuple, zone, net))
return h;
- }
- NF_CT_STAT_INC_ATOMIC(net, searched);
}
/*
* if the nulls value we got at the end of this lookup is
@@ -798,7 +792,6 @@ __nf_conntrack_confirm(struct sk_buff *skb)
*/
__nf_conntrack_hash_insert(ct, hash, reply_hash);
nf_conntrack_double_unlock(hash, reply_hash);
- NF_CT_STAT_INC(net, insert);
local_bh_enable();
help = nfct_help(ct);
@@ -857,7 +850,6 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
rcu_read_unlock();
return 1;
}
- NF_CT_STAT_INC_ATOMIC(net, searched);
}
if (get_nulls_value(n) != hash) {
@@ -1177,10 +1169,8 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
}
spin_unlock(&nf_conntrack_expect_lock);
}
- if (!exp) {
+ if (!exp)
__nf_ct_try_assign_helper(ct, tmpl, GFP_ATOMIC);
- NF_CT_STAT_INC(net, new);
- }
/* Now it is inserted into the unconfirmed list, bump refcount */
nf_conntrack_get(&ct->ct_general);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index c052b712c49f..27540455dc62 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1984,13 +1984,9 @@ ctnetlink_ct_stat_cpu_fill_info(struct sk_buff *skb, u32 portid, u32 seq,
nfmsg->version = NFNETLINK_V0;
nfmsg->res_id = htons(cpu);
- if (nla_put_be32(skb, CTA_STATS_SEARCHED, htonl(st->searched)) ||
- nla_put_be32(skb, CTA_STATS_FOUND, htonl(st->found)) ||
- nla_put_be32(skb, CTA_STATS_NEW, htonl(st->new)) ||
+ if (nla_put_be32(skb, CTA_STATS_FOUND, htonl(st->found)) ||
nla_put_be32(skb, CTA_STATS_INVALID, htonl(st->invalid)) ||
nla_put_be32(skb, CTA_STATS_IGNORE, htonl(st->ignore)) ||
- nla_put_be32(skb, CTA_STATS_DELETE, htonl(st->delete)) ||
- nla_put_be32(skb, CTA_STATS_DELETE_LIST, htonl(st->delete_list)) ||
nla_put_be32(skb, CTA_STATS_INSERT, htonl(st->insert)) ||
nla_put_be32(skb, CTA_STATS_INSERT_FAILED,
htonl(st->insert_failed)) ||
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 3d9a316a3c77..7d52f8401afd 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -352,13 +352,13 @@ static int ct_cpu_seq_show(struct seq_file *seq, void *v)
seq_printf(seq, "%08x %08x %08x %08x %08x %08x %08x %08x "
"%08x %08x %08x %08x %08x %08x %08x %08x %08x\n",
nr_conntracks,
- st->searched,
+ 0,
st->found,
- st->new,
+ 0,
st->invalid,
st->ignore,
- st->delete,
- st->delete_list,
+ 0,
+ 0,
st->insert,
st->insert_failed,
st->drop,
--
2.1.4
next prev parent reply other threads:[~2016-09-25 23:06 UTC|newest]
Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-25 23:06 [PATCH 00/53] Netfilter updates for net-next Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 01/53] netfilter: gre: Use consistent GRE_* macros instead of ones defined by netfilter Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 02/53] netfilter: gre: Use consistent GRE and PTTP header structure instead of the " Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 03/53] netfilter: nf_ct_sip: correct parsing of continuation lines in SIP headers Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 04/53] netfilter: nf_ct_sip: correct allowed characters in Call-ID SIP header Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 05/53] netfilter: ftp: Remove the useless dlen==0 condition check in find_pattern Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 06/53] netfilter: ftp: Remove the useless code Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 07/53] netfilter: nft_numgen: rename until attribute by modulus Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 08/53] netfilter: nft_quota: fix overquota logic Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 09/53] netfilter: nft_quota: introduce nft_overquota() Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 10/53] netfilter: nf_ct_sip: allow tab character in SIP headers Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 11/53] netfilter: nft_queue: check the validation of queues_total and queuenum Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 12/53] netfilter: nf_conntrack: remove unused ctl_table_path member in nf_conntrack_l3proto Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 13/53] netfilter: nft_hash: Add hash offset value Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 14/53] netfilter: nft_dynset: allow to invert match criteria Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 15/53] netfilter: nf_tables: ensure proper initialization of nft_pktinfo fields Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 16/53] netfilter: nf_tables_ipv6: setup pktinfo transport field on failure to parse Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 17/53] netfilter: introduce nft_set_pktinfo_{ipv4, ipv6}_validate() Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 18/53] netfilter: nf_tables_bridge: use nft_set_pktinfo_ipv{4, 6}_validate Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 19/53] netfilter: nf_tables: don't drop IPv6 packets that cannot parse transport Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 20/53] netfilter: nf_conntrack: simplify __nf_ct_try_assign_helper() return logic Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 21/53] netfilter: Add the missed return value check of register_netdevice_notifier Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 22/53] netfilter: Add the missed return value check of nft_register_chain_type Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 23/53] netfilter: nf_queue: get rid of dependency on IP6_NF_IPTABLES Pablo Neira Ayuso
2016-09-25 23:06 ` Pablo Neira Ayuso [this message]
2016-09-25 23:06 ` [PATCH 25/53] netfilter: nft_numgen: fix race between num generate and store it Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 26/53] netfilter: nft_hash: fix hash overflow validation Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 27/53] netfilter: nft_numgen: add number generation offset Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 28/53] netfilter: nf_tables: validate maximum value of u32 netlink attributes Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 29/53] netfilter: nft_queue: add _SREG_QNUM attr to select the queue number Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 30/53] netfilter: nf_queue: improve queue range support for bridge family Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 31/53] netfilter: nf_tables: improve nft payload fast eval Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 32/53] netfilter: nf_tables: check tprot_set first when we use xt.thoff Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 33/53] netfilter: Enhance the codes used to get random once Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 34/53] netfilter: xt_helper: Use sizeof(variable) instead of literal number Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 35/53] netfilter: nft_lookup: remove superfluous element found check Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 36/53] netfilter: xt_TCPMSS: Refactor the codes to decrease one condition check and more readable Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 37/53] netfilter: bridge: add and use br_nf_hook_thresh Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 38/53] netfilter: call nf_hook_state_init with rcu_read_lock held Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 39/53] netfilter: call nf_hook_ingress with rcu_read_lock Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 40/53] netfilter: Remove explicit rcu_read_lock in nf_hook_slow Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 41/53] netfilter: Only allow sane values in nf_register_net_hook Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 42/53] netfilter: nf_queue: whitespace cleanup Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 43/53] netfilter: replace list_head with single linked list Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 44/53] netfilter: seqadj: Fix the wrong ack adjust for the RST packet without ack Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 45/53] netfilter: nft_ct: unnecessary to require dir when use ct l3proto/protocol Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 46/53] netfilter: nft_ct: report error if mark and dir specified simultaneously Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 47/53] netfilter: xt_hashlimit: Prepare for revision 2 Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 48/53] netfilter: xt_hashlimit: Create revision 2 to support higher pps rates Pablo Neira Ayuso
2016-09-25 23:06 ` [PATCH 49/53] netfilter: evict stale entries when user reads /proc/net/nf_conntrack Pablo Neira Ayuso
2016-09-25 23:07 ` [PATCH 50/53] netfilter: xt_socket: fix transparent match for IPv6 request sockets Pablo Neira Ayuso
2016-09-25 23:07 ` [PATCH 51/53] netfilter: nf_tables: add range expression Pablo Neira Ayuso
2016-09-25 23:07 ` [PATCH 52/53] netfilter: nft_log: complete NFTA_LOG_FLAGS attr support Pablo Neira Ayuso
2016-09-25 23:07 ` [PATCH 53/53] netfilter: nf_log: get rid of XT_LOG_* macros Pablo Neira Ayuso
2016-09-26 1:05 ` [PATCH 00/53] Netfilter updates for net-next David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1474844823-2026-25-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).