[Bro] troubleshooting bro memory usage?
lists at g-clef.net
Fri Aug 2 11:33:03 PDT 2013
I've just put in two sensors running bro (with security onion), and am
having trouble with the bro processes progressively growing in RAM
usage, until they crash or become unresponsive. For example, I have one
bro worker process right now that's reached 2.8 GB in 2 hours while
watching a < 100MB link. None of the other processes
(manager/proxy/other workers) are anywhere near that...it's just this
Are there any config options I can enable to attempt to find the cause
of the memory leak? Also, since I'm confident the link I'm watching is
missing some traffic (the span it's on is slightly mis-configured at the
moment), where can I configure protocol timeouts?
More information about the Bro