[Bro] Bro2 Random Crashes

Nicholas Weaver nweaver at ICSI.Berkeley.EDU
Thu Mar 1 06:32:37 PST 2012

On Mar 1, 2012, at 6:02 AM, Chris Crawford wrote:
> The only thing I've been able to key in on, is that over time Bro2
> eventually causes all free memory in Ubuntu to change to cached
> memory.  From the Citrix Xen Console, that cached memory shows up as
> used memory.  So, maybe Xen interprets cached memory as being used?
> Also -- when Xen senses that most of the memory is "used" (but,
> really, it's cached inside Ubuntu), the percent utilization in one of
> the CPUs in the VM spikes.  After Bro2 crashes, CPU utilization
> returns to normal, but memory is never freed -- it remains cached
> forever.

Cached memory IS used memory by the OS.  Modern operating systems are very aggressive about using all available "physical" memory as a disk cache when otherwise not being used, especially Linux variants.  But at the same time, it should also aggressively evict those entries when it think that there are limits on physical memory. [1]

So naturally, a virtual machine should see the disk cache as being "used" memory, since it is being used by the guest OS.  But at the same time, this should not necessarily be a problem, since the guest OS in the virtual machine is managing this memory and will evict it for other, higher priority uses on demand.

But it does bring up a question:  within the virtual machine, how much physical memory does the VM think it has?  How does that compare to the actual allocation to the VM environment?

More information about the Bro mailing list