[Bro-Dev] help Reading the backtrace

Jan Grashöfer jan.grashoefer at gmail.com
Thu Jan 19 01:55:45 PST 2017


> But I also wonder what you are doing that is triggering Dictionary9NextEntryERP7HashKeyRP10IterCookiei
> 
> which would be
> 
> void* Dictionary::NextEntry(HashKey*& h, IterCookie*& cookie, int return_hash) const
> 
> Tables should be fine, but I wonder what you're doing that is triggering so much iteration.

If I am not mistaken, tables are basically dictionaries (with the
exception of subnet-indexed tables). The iterations should be related to
how expiration works: As soon as the timer fires, the table is looped
looking for expired entries. To prevent blocking in case of too many
expired entries that have to be handled, only
<table_incremental_step>-number of entries are processed, following a
delay of <table_expire_delay>. Adjusting this parameters might help (see
https://www.bro.org/sphinx/scripts/base/init-bare.bro.html?highlight=expire#id-table_expire_delay).

Jan


More information about the bro-dev mailing list