[Bro] Version: 2.0-907 -- Bro manager memory exhaustion

Tritium Cat tritium.cat at gmail.com
Mon Jul 30 13:57:05 PDT 2012


I'm using the latest development build 2.0-907.

The deployment consists of six servers; one as a manager and the other five
as nodes.  Each node runs 20 workers and 2 proxies.  The manager is
FreeBSD; the workers are Linux with PF_RING transparent_mode=2.

After starting bro, the manger continually consumes memory until system
exhaustion (64GB).  The CPU usage is high as well.

Another problem is over 50% of the workers consume 100% CPU.  This is very
odd considering the low volume traffic between 400-1000 Mbps per node.

Where do you suggest I start debugging this ?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20120730/3d54ad09/attachment.html 

More information about the Bro mailing list