doc/userguide: minor rewording and reformatting for runmodes

pull/7013/head
Victor Julien 3 years ago
parent 28b5f4a555
commit e04fcfcf2f

@ -7,19 +7,19 @@ computer. Suricata is multi-threaded, so multiple threads are active
at once. A thread-module is a part of a functionality. One module is
for example for decoding a packet, another is the detect-module and
another one the output-module. A packet can be processed by more than
one thread. The packet will be passed on to the next thread through a
queue. Packets will be processed by one thread at a time, but there
can be multiple packets being processed at a time by the engine. (see
:ref:`suricata-yaml-max-pending-packets`) A thread can have one or
one thread. The packet will then be passed on to the next thread through
a queue. Packets will be processed by one thread at a time, but there
can be multiple packets being processed at a time by the engine (see
:ref:`suricata-yaml-max-pending-packets`). A thread can have one or
more thread-modules. If they have more modules, they can only be
active on a a time. The way threads, modules and queues are arranged
together is called the Runmode.
active one a a time. The way threads, modules and queues are arranged
together is called the "Runmode".
Different runmodes
~~~~~~~~~~~~~~~~~~
You can choose a runmode out of several predefined runmodes. The
command line option --list-runmodes shows all available runmodes. All
command line option ``--list-runmodes`` shows all available runmodes. All
runmodes have a name: single, workers, autofp.
Generally, the ``workers`` runmode performs the best. In this mode the
@ -39,8 +39,8 @@ on to the ``flow worker`` threads.
.. image:: runmodes/autofp2.png
Finally, the ``single`` runmode is the same as the ``workers`` mode,
however there is only a single packet processing thread. This useful
during development.
however there is only a single packet processing thread. This is mostly
useful during development.
.. image:: runmodes/single.png

Loading…
Cancel
Save