[Bro-Dev] #949: High CPU from polling loop on low traffic links

Bro Tracker bro at tracker.bro-ids.org
Fri Mar 1 10:40:31 PST 2013

#949: High CPU from polling loop on low traffic links
  Reporter:  liamrandall  |      Owner:
      Type:  Problem      |     Status:  new
  Priority:  Low          |  Milestone:  Bro2.2
 Component:  Bro          |    Version:  git/master
Resolution:               |   Keywords:

Comment (by seth):

 > This machine is already running an IDS...Bro would be complementing
 > That said, I can't have Bro taking up 50% CPU with no traffic running.
 > perception (expectation?) is that high traffic = high cpu, low traffic =
 > low cpu...though that my not be accurate or reasonable.  Thanks for all
 > your work on this Seth.

 Once traffic starts flowing through the box, Bro's CPU load will start to
 drop (oddly enough) until eventually it starts to go back up again if the
 traffic load is high enough.

 Bro needs to take care of a lot of housekeeping tasks and we keep a fairly
 tight loop to make sure that everything is taken care of with low latency.
 We are drawing up plans for some rework to our communication code (which
 contributes to the tight loop) and it may take care of some of the load

Ticket URL: <http://tracker.bro-ids.org/bro/ticket/949#comment:5>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker

More information about the bro-dev mailing list