<div dir="ltr">Hi,<div><br></div><div>I would try to monitor the cpu \ mem usage of the logger instance.</div><div>Try running broctl top, my guess is that you will see that the logger process will have a very high cpu usage.</div><div><br></div><div>I know of an option to have multiple loggers but I am not sure how to set it up.</div><div><br></div><div>Are you writing to a file ?</div><div><br></div><div>B </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Sep 19, 2019 at 7:14 PM Kayode Enwerem <<a href="mailto:Kayode_Enwerem@ao.uscourts.gov">Kayode_Enwerem@ao.uscourts.gov</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_3675989124619708856WordSection1">
<p class="MsoNormal">Hello,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Why does my logger keep crashing? Can someone please help me with this. I have provided some system information below:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I am running bro version 2.6.3<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<ol style="margin-top:0in" start="1" type="1">
<li class="gmail-m_3675989124619708856MsoListParagraph" style="margin-left:0in">Output of broctl status. The logger is crashed but the manager, proxy and workers are still running.
<u></u><u></u></li></ol>
<p class="MsoNormal">broctl status<u></u><u></u></p>
<p class="MsoNormal"><b>Name Type Host Status Pid Started<u></u><u></u></b></p>
<p class="MsoNormal"><span style="color:red">logger logger localhost crashed<u></u><u></u></span></p>
<p class="MsoNormal">manager manager localhost running 17356 09 Sep 15:42:24<u></u><u></u></p>
<p class="MsoNormal">proxy-1 proxy localhost running 17401 09 Sep 15:42:25<u></u><u></u></p>
<p class="MsoNormal">worker-1-1 worker localhost running 17573 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-2 worker localhost running 17569 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-3 worker localhost running 17572 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-4 worker localhost running 17587 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-5 worker localhost running 17619 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-6 worker localhost running 17614 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-7 worker localhost running 17625 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-8 worker localhost running 17646 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-9 worker localhost running 17671 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-10 worker localhost running 17663 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-11 worker localhost running 17679 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-12 worker localhost running 17685 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-13 worker localhost running 17698 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-14 worker localhost running 17703 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-15 worker localhost running 17710 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-16 worker localhost running 17717 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-17 worker localhost running 17720 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-18 worker localhost running 17727 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-19 worker localhost running 17728 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal">worker-1-20 worker localhost running 17731 09 Sep 15:42:27<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<ol style="margin-top:0in" start="2" type="1">
<li class="gmail-m_3675989124619708856MsoListParagraph" style="margin-left:0in">Here’s my node.cfg settings<u></u><u></u></li></ol>
<p class="MsoNormal">[logger]<u></u><u></u></p>
<p class="MsoNormal">type=logger<u></u><u></u></p>
<p class="MsoNormal">host=localhost<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">[manager]<u></u><u></u></p>
<p class="MsoNormal">type=manager<u></u><u></u></p>
<p class="MsoNormal">host=localhost<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">[proxy-1]<u></u><u></u></p>
<p class="MsoNormal">type=proxy<u></u><u></u></p>
<p class="MsoNormal">host=localhost<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">[worker-1]<u></u><u></u></p>
<p class="MsoNormal">type=worker<u></u><u></u></p>
<p class="MsoNormal">host=localhost<u></u><u></u></p>
<p class="MsoNormal">interface=af_packet::ens2f0<u></u><u></u></p>
<p class="MsoNormal">lb_method=custom<u></u><u></u></p>
<p class="MsoNormal">#lb_method=pf_ring<u></u><u></u></p>
<p class="MsoNormal">lb_procs=20<u></u><u></u></p>
<p class="MsoNormal">pin_cpus=6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25<u></u><u></u></p>
<p class="MsoNormal">af_packet_fanout_id=25<u></u><u></u></p>
<p class="MsoNormal">af_packet_fanout_mode=AF_Packet::FANOUT_HASH<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<ol style="margin-top:0in" start="3" type="1">
<li class="gmail-m_3675989124619708856MsoListParagraph" style="margin-left:0in">Heres more information on my CPU. 32 CPUs, model name – AMD, CPU max MHz is 2800.0000<u></u><u></u></li></ol>
<p class="MsoNormal">Architecture: x86_64<u></u><u></u></p>
<p class="MsoNormal">CPU op-mode(s): 32-bit, 64-bit<u></u><u></u></p>
<p class="MsoNormal">Byte Order: Little Endian<u></u><u></u></p>
<p class="MsoNormal">CPU(s): 32<u></u><u></u></p>
<p class="MsoNormal">On-line CPU(s) list: 0-31<u></u><u></u></p>
<p class="MsoNormal">Thread(s) per core: 2<u></u><u></u></p>
<p class="MsoNormal">Core(s) per socket: 8<u></u><u></u></p>
<p class="MsoNormal">Socket(s): 2<u></u><u></u></p>
<p class="MsoNormal">NUMA node(s): 4<u></u><u></u></p>
<p class="MsoNormal">Vendor ID: AuthenticAMD<u></u><u></u></p>
<p class="MsoNormal">CPU family: 21<u></u><u></u></p>
<p class="MsoNormal">Model: 2<u></u><u></u></p>
<p class="MsoNormal">Model name: AMD Opteron(tm) Processor 6386 SE<u></u><u></u></p>
<p class="MsoNormal">Stepping: 0<u></u><u></u></p>
<p class="MsoNormal">CPU MHz: 1960.000<u></u><u></u></p>
<p class="MsoNormal">CPU max MHz: 2800.0000<u></u><u></u></p>
<p class="MsoNormal">CPU min MHz: 1400.0000<u></u><u></u></p>
<p class="MsoNormal">BogoMIPS: 5585.93<u></u><u></u></p>
<p class="MsoNormal">Virtualization: AMD-V<u></u><u></u></p>
<p class="MsoNormal">L1d cache: 16K<u></u><u></u></p>
<p class="MsoNormal">L1i cache: 64K<u></u><u></u></p>
<p class="MsoNormal">L2 cache: 2048K<u></u><u></u></p>
<p class="MsoNormal">L3 cache: 6144K<u></u><u></u></p>
<p class="MsoNormal">NUMA node0 CPU(s): 0,2,4,6,8,10,12,14<u></u><u></u></p>
<p class="MsoNormal">NUMA node1 CPU(s): 16,18,20,22,24,26,28,30<u></u><u></u></p>
<p class="MsoNormal">NUMA node2 CPU(s): 1,3,5,7,9,11,13,15<u></u><u></u></p>
<p class="MsoNormal">NUMA node3 CPU(s): 17,19,21,23,25,27,29,31<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<ol style="margin-top:0in" start="4" type="1">
<li class="gmail-m_3675989124619708856MsoListParagraph" style="margin-left:0in">Would also like to know how I can reduce my packet loss. Below is the output of broctl netstats<u></u><u></u></li></ol>
<p class="MsoNormal">broctl netstats<u></u><u></u></p>
<p class="MsoNormal">worker-1-1: 1568908277.861813 recvd=12248845422 dropped=5171188999 link=17420313882<u></u><u></u></p>
<p class="MsoNormal">worker-1-2: 1568908298.313954 recvd=8636707266 dropped=971489 link=8637678939<u></u><u></u></p>
<p class="MsoNormal">worker-1-3: 1568908278.425888 recvd=11684808853 dropped=5617381647 link=17302473791<u></u><u></u></p>
<p class="MsoNormal">worker-1-4: 1568908285.731130 recvd=12567242226 dropped=4339688288 link=16907212802<u></u><u></u></p>
<p class="MsoNormal">worker-1-5: 1568908298.363911 recvd=8620499351 dropped=24595149 link=8645095758<u></u><u></u></p>
<p class="MsoNormal">worker-1-6: 1568908298.372892 recvd=8710565757 dropped=1731022 link=8712297432<u></u><u></u></p>
<p class="MsoNormal">worker-1-7: 1568908298.266010 recvd=9065207444 dropped=53523232 link=9118737229<u></u><u></u></p>
<p class="MsoNormal">worker-1-8: 1568908286.935607 recvd=11377790124 dropped=3680887247 link=15058934491<u></u><u></u></p>
<p class="MsoNormal">worker-1-9: 1568908298.419657 recvd=8931903322 dropped=39696184 link=8971604219<u></u><u></u></p>
<p class="MsoNormal">worker-1-10: 1568908298.478576 recvd=8842874030 dropped=2501252 link=8845376352<u></u><u></u></p>
<p class="MsoNormal">worker-1-11: 1568908298.506649 recvd=8692769329 dropped=2253413 link=8695025626<u></u><u></u></p>
<p class="MsoNormal">worker-1-12: 1568908298.520830 recvd=8749977028 dropped=2314733 link=8752293714<u></u><u></u></p>
<p class="MsoNormal">worker-1-13: 1568908298.544573 recvd=9101243757 dropped=1779460 link=9103025399<u></u><u></u></p>
<p class="MsoNormal">worker-1-14: 1568908291.370011 recvd=10876925726 dropped=775722632 link=11652810353<u></u><u></u></p>
<p class="MsoNormal">worker-1-15: 1568908298.579721 recvd=8503097394 dropped=1420699 link=8504520066<u></u><u></u></p>
<p class="MsoNormal">worker-1-16: 1568908298.594942 recvd=8515164266 dropped=1840977 link=8517006779<u></u><u></u></p>
<p class="MsoNormal">worker-1-17: 1568908298.646966 recvd=10666567717 dropped=466489754 link=11133059283<u></u><u></u></p>
<p class="MsoNormal">worker-1-18: 1568908298.671246 recvd=9023603573 dropped=2037607 link=9025642263<u></u><u></u></p>
<p class="MsoNormal">worker-1-19: 1568908298.704675 recvd=8907784186 dropped=1164594 link=8908950238<u></u><u></u></p>
<p class="MsoNormal">worker-1-20: 1568908298.718084 recvd=9140525444 dropped=2028593 link=9142555259<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks, <u></u><u></u></p>
</div>
</div>
_______________________________________________<br>
Zeek mailing list<br>
<a href="mailto:zeek@zeek.org" target="_blank">zeek@zeek.org</a><br>
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel="noreferrer" target="_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a></blockquote></div>