[Bro-Dev] [JIRA] (BIT-1038) Input framework memory usage issue with huge files

Seth Hall (JIRA) jira at bro-tracker.atlassian.net
Thu Nov 7 07:26:31 PST 2013


     [ https://bro-tracker.atlassian.net/browse/BIT-1038?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Seth Hall updated BIT-1038:
---------------------------

    Resolution: Fixed
        Status: Closed  (was: Open)

I believe this ticket is fixed.

> Input framework memory usage issue with huge files
> --------------------------------------------------
>
>                 Key: BIT-1038
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1038
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: Bro
>    Affects Versions: git/master
>            Reporter: scampbell
>            Assignee: Bernhard Amann
>             Fix For: 2.2
>
>
> When using the input framework to read a data file and convert into an event stream, it seems that none of the objects instantiated for event generation are freed up.  For a file of ~ 5.25 M lines, I am seeing > 4 GB memory used.
> Version is 2.1-798
> A quick demo script looks like:
> event bro_init()
> 	\{
> 	# input stream setup
> 	Input::add_event([$reader=Input::READER_RAW, $mode=Input::STREAM, $name="issh", $fields=lineVals, $ev=sshLine|$source=data_file,]);
> 	}
> event sshLine(description: Input::EventDescription, tpe: Input::Event, LV: lineVals)
> 	\{
>         return;
>         }
> thanks\!
> scott



--
This message was sent by Atlassian JIRA
(v6.2-OD-01#6204)


More information about the bro-dev mailing list