[Bro] question about intel files
philosnef at yahoo.com
Wed Aug 3 07:42:22 PDT 2016
Because, on boxes where we arent consistently rebooting bro, we are having oomkiller nuking splunk and bro.
On Wednesday, August 3, 2016 10:39 AM, "Azoff, Justin S" <jazoff at illinois.edu> wrote:
> On Aug 3, 2016, at 10:33 AM, philosnef <philosnef at yahoo.com> wrote:
> This was about 2 hours after Bro was rebooted. Here is the output of a bro box with nearly identical throughput that has had bro up and running for the past 48 hours. As you can see, the buffer at this rate has shot up to 4g per parent. If I did not reboot the first box reported every 8 hours or so, we would see the same result there.
> $ free -m
> total used free shared buffers cached
> Mem: 387495 375736 11758 0 1073 248216
> -/+ buffers/cache: 126446 261048
> Swap: 15999 267 15732
This box has 256G of ram free.
I'm sorry but I just don't see where you have a problem here.
- Justin Azoff
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro