[Bro-Dev] manager crash

Seth Hall seth at icir.org
Mon Sep 26 09:25:57 PDT 2011


On Sep 26, 2011, at 11:59 AM, Martin Holste wrote:

> Well, there is high CPU and high volume almost all of the time, and
> all of the workers are still up and running, so this seems to be a
> volume issue.


Is your weird.log file oddly large?  I've been seeing communications overload occasionally that is in part due to a lot of weird log messages.  I'm becoming really tempted to turn off weird messages but measure some of them through the metrics framework to find where there might be issues (due to checksum offloading, async routing, load balancing problems etc, abundance of out of order traffic, etc).

 .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/




More information about the bro-dev mailing list