Performance/spike detective: kiss_hash_find_hashent ?

[Hugo_vd_Kooij]

I was looking into an issue and I was wondering what I was looking at:

# Overhead Command Shared Object Symbol
# ........ ....... ..................... ............................................
#
72.56% fw_full libkiss_apps.so [.] kiss_hash_find_hashent

Not all spikes show this but a significant number of them so I am curious what the function is doing.

So far I had no luck with Secure Knowledge.

[Timothy_Hall]

Kiss stands for kernel infrastructure, which is a kind of generic module that performs a lot of functions.  The most prominent component of kiss that can consume CPU would probably be the pattern matcher which usually means the IPS blade or possibly custom site/application matching that is using the undesirable "*" character.  See Custom Sites and RegExp Wildcard Efficiency.  The function name would suggest it is performing some kind of optimized hash table lookup.

Note that live Pattern Matcher CPU resource utilization can be baselined in cpview on the Advanced...CPU-Profiler...PM-Stats screen. The hcp test category "Custom Applications RegEx" will also flag any Custom Applications/Sites that utilize the undesirable wildcard character "*" that can significantly increase PM overhead.