From 3012edae1cc3989d6b461366b06672e3c7776d5c Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Thu, 17 Nov 2016 14:27:41 +0100
Subject: [PATCH] luajit: update default yaml and doc for 'states'

---
 doc/userguide/configuration/suricata-yaml.rst | 22 +++++++++++++++++++
 suricata.yaml.in                              |  9 ++++++++
 2 files changed, 31 insertions(+)

diff --git a/doc/userguide/configuration/suricata-yaml.rst b/doc/userguide/configuration/suricata-yaml.rst
index ab04dc1d00..8feee0f538 100644
--- a/doc/userguide/configuration/suricata-yaml.rst
+++ b/doc/userguide/configuration/suricata-yaml.rst
@@ -2188,3 +2188,25 @@ unlimited.
       modbus:
         # Stream reassembly size for modbus, default is 0
         stream-depth: 0
+
+Advanced Options
+----------------
+
+luajit
+~~~~~~
+
+states
+^^^^^^
+
+Luajit has a strange memory requirement, it's 'states' need to be in the
+first 2G of the process' memory. For this reason when luajit is used the
+states are allocated at the process startup. This option controls how many
+states are preallocated.
+
+If the pool is depleted a warning is generated. Suricata will still try to
+continue, but may fail if other parts of the engine take too much memory.
+If the pool was depleted a hint will be printed at the engines exit.
+
+States are allocated as follows: for each detect script a state is used per
+detect thread. For each output script, a single state is used. Keep in
+mind that a rule reload temporary doubles the states requirement.
diff --git a/suricata.yaml.in b/suricata.yaml.in
index 1a431dc334..e701c335c6 100644
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -1381,6 +1381,15 @@ threading:
   #
   detect-thread-ratio: 1.0
 
+# Luajit has a strange memory requirement, it's 'states' need to be in the
+# first 2G of the process' memory.
+#
+# 'luajit.states' is used to control how many states are preallocated.
+# State use: per detect script: 1 per detect thread. Per output script: 1 per
+# script.
+luajit:
+  states: 128
+
 # Profiling settings. Only effective if Suricata has been built with the
 # the --enable-profiling configure flag.
 #