在suricata.c的main函数执行完RunModeDispatch之后会在判断是否使用UNIX_SOCKET中调用FlowManagerThreadSpawn创建流管理线程。
/** \brief spawn the flow manager thread */
void FlowManagerThreadSpawn()
{
#ifdef AFLFUZZ_DISABLE_MGTTHREADS
return;
#endif
intmax_t setting = 1;
(void)ConfGetInt("flow.managers", &setting);
//从配置文件获取希望开开启的flowmanagers线程的个数。
if (setting < 1 || setting > 1024) {
SCLogError(SC_ERR_INVALID_ARGUMENTS,
"invalid flow.managers setting %"PRIdMAX, setting);
exit(EXIT_FAILURE);
}
flowmgr_number = (uint32_t)setting;
SCLogConfig("using %u flow manager threads", flowmgr_number);
SCCtrlCondInit(&flow_manager_ctrl_cond, NULL);
//内部调用pthread_cond_init初始化条件变量
SCCtrlMutexInit(&flow_manager_ctrl_mutex, NULL);
//内部调用pthread_mutex_init初始化互斥锁
StatsRegisterGlobalCounter("flow.memuse", FlowGetMemuse);
//注册"flow.memuse"和回调函数FlowGetMemuse到全局变量stats_ctx的成员列表末尾。
uint32_t u;
for (u = 0; u < flowmgr_number; u++)
{
//默认flowmgr_number为1
ThreadVars *tv_flowmgr = NULL;
char name[TM_THREAD_NAME_MAX];
snprintf(name, sizeof(name), "%s#%02u", thread_name_flow_mgr, u+1);
tv_flowmgr = TmThreadCreateMgmtThreadByName(name,
"FlowManager", 0);
//得到一个ThreadVars 变量tv_flowmgr,其中tv_flowmgr->tm_slots = tmm_modules[TMM_FLOWMANAGER];还是最重要的在TmThreadCreate函数中调用TmThreadSetSlots,使得tv_flowmgr->tm_func = TmThreadsManagement;TmThreadsManagement是下面TmThreadSpawn创建线程时的运行函数,流管理的初始化及流管理函数FlowManager都是在TmThreadsManagement里面调的。
BUG_ON(tv_flowmgr == NULL);
if (tv_flowmgr == NULL) {
printf("ERROR: TmThreadsCreate failed\n");
exit(1);
}
if (TmThreadSpawn(tv_flowmgr) != TM_ECODE_OK) {
printf("ERROR: TmThreadSpawn failed\n");
exit(1);
}
//创建流管理线程。
}
return;
}