[Bro-Dev] manager-child cpu utilization?

[Seth Hall]

I'm seeing what appears to be extremely high CPU utilization by the manager's child process in a rather large (23 worker?) cluster.  I believe the deserialization is being done by the child process and I'm guessing that the child process is being overwhelmed by all of the deserialization it's having to do for the logging framework's log records.  

Any one have thoughts about if I'm correct or ways this could be optimized?  I'm just worried this could become a problem because logs are written much faster at other sites and I can see other sites getting communication framework overload really easily.  I think it's something that we need to keep a close eye on at least.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/