[Bro] Stand-alone cluster problems
Tyler T. Schoenke
Tyler.Schoenke at colorado.edu
Tue Jun 16 09:40:35 PDT 2009
I pulled the svn code from 6/15, and got the following error when
Generating code for SSLRecordLayerFlow
g++ -DHAVE_CONFIG_H -I. -I.. -I. -I../aux/binpac/lib -I../src -I. -I..
-O -I/usr/local/include -W -Wall -Wno-unused -g -O2 -MT main.o -MD
-MP -MF .deps/main.Tpo -c -o main.o main.cc
In file included from Frame.h:11,
Val.h:853: error: extra qualification 'TableVal::' on member 'RecursiveSize'
main.cc: In function 'int main(int, char**)':
main.cc:452: warning: deprecated conversion from string constant to 'char*'
*** Error code 1
Am I missing some dependency?
In the meantime, I'll try unloading some of the scripts to drop the
Robin Sommer wrote:
> Hi Tyler,
> a number of thoughts:
> - increasing the BPF buffer sizes is definitly important and should
> generally reduce drops.
> - the top output shows that the Bro process is actually swapping out
> memory to disk:
>> PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND
>> 51061 XXXXXX 1 -20 0 1207M 843M swread 1 606:53 0.00%
> Once that happens, pretty much all bets are off regarding drops: the
> I/O load will dominate everything else and Bro almost certainly drop
> tons of packets.
> - the stack backtrace shows a piece of code where we just found a
> problem in the version checked into my branch, which has the
> potential to cause drops with large tables. I can't tell whether
> it's a coincidence or indeed causing trouble in your case. In any
> case, I've committed a fix, please update your working copy and
> recompile to see whether that makes any difference.
More information about the Bro