<div dir="ltr">Hi Jon,<div><br></div><div>Even in the latest zeek version which is 3.1.3, it reaches 100% when I integrate Input framework,</div><div><br></div><div><b>cat
/tmp/file_port_list
</b></div><div><div style="box-sizing:border-box;font-family:"Segoe UI",system-ui,"Apple Color Emoji","Segoe UI Emoji",sans-serif;font-size:14px">#fields port_num<br>
60000/tcp<br>
8080/tcp<br>
49154/tcp<br>
55907/tcp<br>
49152/tcp<br>
49153/tcp<br>
8000/tcp<br>
5357/tcp<br>
80/tcp</div></div><div><br></div><div><b>cat test.zeek</b></div><div><div style="box-sizing:border-box;font-family:"Segoe UI",system-ui,"Apple Color Emoji","Segoe UI Emoji",sans-serif;font-size:14px"><div>global file_port_list: set[port] = set();</div><div>
<div>
<div>global file_port_list_loc: string = "/tmp/file_port_list";</div><div>
<div>
<div>type Portsx: record {<br>
port_num: port;<br>
};</div><div>
<div>
<div>event zeek_init() &priority=5<br>
{<br>
suspend_processing();<br> Input::add_table([$source=file_port_list_loc, $name="file_port_list", $idx=Portsx, $destination=file_port_list]);</div><div>
<div>
<div> Input::remove("file_port_list");</div><div>
<div>
<div>}</div></div></div></div></div></div></div></div></div></div></div></div></div><div><br></div><div>Regards,</div><div>Nabil</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, May 26, 2020 at 11:05 PM Nabil Memon <<a href="mailto:nabilmemon.ec@gmail.com">nabilmemon.ec@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto">I am using 2.6.x version.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 26 May, 2020, 10:53 pm Jon Siwek, <<a href="mailto:jsiwek@corelight.com" target="_blank">jsiwek@corelight.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Tue, May 26, 2020 at 8:47 AM Nabil Memon <<a href="mailto:nabilmemon.ec@gmail.com" rel="noreferrer" target="_blank">nabilmemon.ec@gmail.com</a>> wrote:<br>
<br>
> I got caught up in some other side effect. Bro's CPU usage goes 100% when I use input framework<br>
<br>
What version are you using? You should try comparing against one of<br>
the latest 3.0.x or 3.1.x releases since there's specifically things<br>
addressed in them that might explain that behavior. E.g.<br>
<a href="https://github.com/zeek/broker/pull/97" rel="noreferrer noreferrer" target="_blank">https://github.com/zeek/broker/pull/97</a><br>
<br>
- Jon<br>
</blockquote></div>
</blockquote></div>