[Bro] Version: 2.0-907 -- Bro manager memory exhaustion
tritium.cat at gmail.com
Tue Jul 31 16:50:05 PDT 2012
On Tue, Jul 31, 2012 at 3:11 PM, Robin Sommer <robin at icir.org> wrote:
> > After starting bro, the manger continually consumes memory until system
> > exhaustion (64GB). The CPU usage is high as well.
> That's not a good sign for the manager ... It's possible that we have
> a memory leak in there. Has it worked better with 2.0? (If you have
> tried that?)
I had the same problem with earlier development builds and 2.0 but the
exhaustion was not as rapid. I suspect the number of peers has some
influence in triggering or accelerating a leak.
> > Another problem is over 50% of the workers consume 100% CPU. This is
> > odd considering the low volume traffic between 400-1000 Mbps per node.
> So that's 400-1000 Mbps divided by 20 workers processes? I'll let
> other's chime in here, not really sure what to expect with PF_RING in
> that setup.
I based the design on the very rough suggestion each core will handle
60-120 Mbps of traffic. So 20 workers on a 48 core would be 1.2 Gbps to
2.4 Gbps. I want to say I even recall reading about that threshold in a
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro