[Bro] Memory leak?

Joe Blow blackhole.em at gmail.com
Mon Sep 22 07:19:00 PDT 2014

Hey guys,

I'm trying to figure out if there is a memory leak in Bro that's causing me
issues.  I wonder if it's a memory leak because every few hours i'll have a
worker die like this:


If you want to help us debug this problem, then please forward this mail to
reports at bro.org

Bro 2.3.1

Linux 2.6.32-358.11.1.el6.x86_64

==== No reporter.log

==== stderr.log

listening on bond1, capture length 8192 bytes

1411357505.663118 processing suspended

1411357505.663118 processing continued

1411392324.017784 received termination signal

1411392324.017784 105126164 packets received on interface bond1, 0 dropped

==== stdout.log

max memory size         (kbytes, -m) unlimited

data seg size           (kbytes, -d) unlimited

virtual memory          (kbytes, -v) unlimited

core file size          (blocks, -c) unlimited

==== .cmdline

-i bond1 -U .status -p broctl -p broctl-live -p local -p worker-0-3
local.bro broctl base/frameworks/cluster local-worker.bro broctl/auto

 ==== .env_vars




 ==== .status


 ==== No prof.log

 ==== No packet_filter.log

 ==== No loaded_scripts.log


[Automatically generated.]

The picture of the system's memory looks like this:

[image: Inline image 1]

This sort of corresponds with the crashing of Bro.  Any ideas?  Where would
you guys start digging if the workers just started dying (seemingly)


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140922/3dd55f80/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 21941 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140922/3dd55f80/attachment.bin 

More information about the Bro mailing list