[Bro] building a new bro server

Clark, Gilbert gc355804 at ohio.edu
Tue Dec 9 10:22:13 PST 2014

A few other memory-related things, for what they're worth:

* Make sure vm.swappiness is turned way down
* numactl / numastat could be useful to play with: memory locality can make a difference
* Related to memory locality: try tweaking vm.zone_reclaim_mode

If you're into lower-level tuning / analysis, I also like:


From: bro-bounces at Bro.ORG <bro-bounces at Bro.ORG> on behalf of Seth Hall <seth at icir.org>
Sent: Tuesday, December 09, 2014 1:00 PM
To: Allen, Brian
Cc: bro at bro.org List
Subject: Re: [Bro] building a new bro server

> On Dec 8, 2014, at 10:57 PM, Allen, Brian <BrianAllen at wustl.edu> wrote:
> We saw a huge improvement when we went from 16Gig RAM to 128Gig RAM. (That one was pretty obvious so we did that first).  We also saw improvement when we pinned the processes to the cores.

I think I had also suggested that you move to tcmalloc.  Have you tried that yet?  It’s not going to fix your issue with 30% packet loss, but I expect it would cut it down a bit further.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

Bro mailing list
bro at bro-ids.org

More information about the Bro mailing list