[Bro] out of memory after a couple days?

Gary Faulkner gary at doit.wisc.edu
Thu Dec 5 15:53:26 PST 2013

It seems like oom-killer got invoked on one host and then then 2 minutes 
later on another host in my cluster. The load-balancer should be sending 
each host unique traffic at any given moment. Only 3 workers out of 
around 40 got killed, but then 3 of my proxies crashed. Cooincidentally 
as I was writing this I just ran out of RAM again after 24 hours of 


Gary Faulkner
UW Madison
Office of Campus Information Security

On 12/5/2013 10:20 AM, Seth Hall wrote:
> On Dec 5, 2013, at 9:12 AM, Mike Patterson <mike.patterson at uwaterloo.ca> wrote:
>> That was my assumption too. I upgraded on 8 November, leaked early AM 16th, and then again on the 29th. Traffic would have been at an ebb on the 16th, and rising on the 29th, so I don’t think it’s sheer volume - as you say, there must be something *in* the traffic. Or more likely, a sequence of things, otherwise I expect 2.2 would be vomiting all over my RAM far more often.
> Another question I had is if you're only seeing it on a couple of worker processes or if it's all of them?
> That might narrow it down a bit to tell us if it's just a single connection doing something weird that is causing it or if it's something larger.
>    .Seth
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6257 bytes
Desc: S/MIME Cryptographic Signature
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20131205/28164518/attachment.bin 

More information about the Bro mailing list