[Bro] Manager swapping..

Johanna Amann johanna at icir.org
Tue Apr 25 08:01:04 PDT 2017

Oh, that is interesting.

Just to check - this was on 2.5?

Would you potentially be up for a little bit of digging to see what is
causing this? I am not aware of anyone encountering this problem before,
and I really would like this not to happen :)

If you are ok with it, I will supply you with an instrumented version of
the validation script that outputs a bit of debugging information to help
me check what is going on here.


On Thu, Mar 23, 2017 at 03:40:32PM +0000, Hovsep Levi wrote:
> Try disabling the SSL/TLS cert verification.  I'm not sure why but
> that helped, without it the manager would slowly climb to massive
> memory usage.  Now it works fine for one or two weeks before
> unexpectedly using all memory.
> #@load protocols/ssl/validate-certs
> Good:
> Name         Type    Host             Pid     Proc    VSize  Rss  Cpu   Cmd
> logger-1     logger   6241    parent  701M   163M  20%  bro
> logger-1     logger   6261    child   458M    69M   3%  bro
> manager      manager   6345    child   510M   377M 100%  bro
> manager      manager   6292    parent  890M   804M  24%  bro
> Bad:
> Name         Type    Host             Pid     Proc    VSize  Rss  Cpu   Cmd
> logger-1     logger   52731   parent    1G   806M   0%  bro
> logger-1     logger   52951   child     8G     8G   0%  bro
> manager      manager   53127   child     1G   742M   0%  bro
> manager      manager   52979   parent  1573G  100G   0%  bro
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro

More information about the Bro mailing list