[Bro] Troubleshooting crashes
Siwek, Jonathan Luke
jsiwek at illinois.edu
Thu Sep 13 09:37:31 PDT 2012
>> The front-end setup is working ok. I was missing PFRINGClusterID in broctl.conf; fixing that seems to have helped with memory and cpu usage.
> Oh, that should have been set already. Well, I suppose it might not have been if you upgraded this installation from a previous non-pf_ring enabled installation.
> It may be time to revisit our decision to only set that variable when building against a pf_ring enabled libpcap since this "upgrading to pf_ring" problem exposes itself. Daniel, Jon, what do you guys think?
The PF_RING user's guide has a note about recompiling existing applications in the section about libpfring and libpcap installation. As long as that happens, I think Bro should already automatically upgrade to use it because the default value for PFRINGClusterID in $prefix/lib/broctl/BroControl/options.py gets overwritten by the new installation (no change to broctl.conf is technically necessary, setting it there is probably for advanced users or maybe if the default value happens to conflict with another application).
More information about the Bro