[Bro] Packet loss during log rotation
seth at icir.org
Tue Sep 23 11:33:37 PDT 2014
On Sep 23, 2014, at 2:14 PM, Damian Gerow <damian.gerow at shopify.com> wrote:
> I'm trying to set up a new standalone Bro instance, but I seem to be experiencing regular packet loss. The host is processing minimal traffic -- always <10Mbps, usually around 2Mbps -- but I've noticed that the packet loss almost always occurs at time of log rotation.
Are you running in cluster mode or standalone? If you're running in standalone, it's very possible that something is blocking briefly when the logs are rotated which could cause a small back up of packets, leading to loss.
International Computer Science Institute
(Bro) because everyone has a network
More information about the Bro