[Bro] Packet loss during log rotation

Seth Hall seth at icir.org
Tue Sep 23 11:33:37 PDT 2014

On Sep 23, 2014, at 2:14 PM, Damian Gerow <damian.gerow at shopify.com> wrote:

> I'm trying to set up a new standalone Bro instance, but I seem to be experiencing regular packet loss.  The host is processing minimal traffic -- always <10Mbps, usually around 2Mbps -- but I've noticed that the packet loss almost always occurs at time of log rotation.

Are you running in cluster mode or standalone?  If you're running in standalone, it's very possible that something is blocking briefly when the logs are rotated which could cause a small back up of packets, leading to loss.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list