modsecurity2.9.x vs modsecurity v3.0 performance

[zorogong]

i test modsecurity2.9.0 ,modsecurity2.9.1, modsecurity2.9.2 and modsecurity v3.0, i found modsecurity v3.0 performance much lower in the same case, why ?

test result:
modsecurity2.9.0 ,modsecurity2.9.1, modsecurity2.9.2 : cpu usage 50%, tps 700/s
modsecurity v3.0 : cpu usage 95%, tps 300 /s

test condition:
4 cpu
10 G memery
crs 3 latest, default rule set
openresty 1.11.2 + modsecurity

[victorhora]

For performance test and results for v3 please refer to the performance setup/tests by @defanator here:

https://github.com/defanator/modsecurity-performance/wiki

Would be great if you could mimic a similar setup (e.g. Vagrant) so we can compare with that baseline :)

[zimmerle]

Hi @zorogong,

Like @victorhora mentioned, we consider @defanator's performance tests as the official test.

Your comparison may not be a fair test as we may or not may have the ModSecurity v2.x fully workable on nginx. I would invite you to make this performance test with and without ModSecurity v3 to understand the performance damage that you are suffering and why. Notice, also, that the most important factor is the latency, we expect to have a lower latency to give the user the results as fast as possible.