From dumortie at student.fsa.ucl.ac.be Thu Apr 29 12:34:12 1999 From: dumortie at student.fsa.ucl.ac.be (Alexandre Dumortier) Date: Thu, 29 Apr 1999 21:34:12 +0200 (MET DST) Subject: Virtual Memory exceeded Message-ID: Hi, We've got some trouble with bro... After about 2 hours running bro (mt script), bro crash with a : "Virtual Memory exceeded in 'new'" Error. Can someone suggest me what I can do about this (I've already increased RAM and swap from 32Mb to 64Mb) ? Is there a way to check what part of bro is taking whole this memory (stream buffers or active sessions table, ...) Config PC: Pentium 200 Mhz 64 Mb RAM Config OS: Redhat 5.2 64 Mb Swap space. original 486 kernel version (I didn't recompile kernel to be sure to have the most standard config). no errors reported in syslog Config BRO: bro 0.5a script mt.bro regards, Patrick Verstraete Alexandre Dumortier Universite catholique de Louvain, Belgium Here follows status taken every ten minutes. FLAGS UID PID PPID PRI NI SIZE RSS WCHAN STA TTY TIME COMMAND Thu Apr 29 17:17:47 CEST 1999 100100 0 1164 890 9 5 28308 27760 R N p0 0:26 bro -i et Thu Apr 29 17:20:00 CEST 1999 100100 0 1164 890 10 5 34328 33780 skb_recv_da S N p0 0:32 bro -i et Thu Apr 29 17:30:00 CEST 1999 100100 0 1164 890 9 5 56952 56392 skb_recv_da S N p0 0:53 bro -i et Thu Apr 29 17:40:01 CEST 1999 100100 0 1164 890 12 5 75260 58088 R N p0 1:10 bro -i et Thu Apr 29 17:50:01 CEST 1999 100100 0 1164 890 9 5 89332 58000 skb_recv_da S N p0 1:27 bro -i et Thu Apr 29 18:00:02 CEST 1999 100100 0 1164 890 17 5 102876 59004 skb_recv_da S N p0 1:49 bro -i et From vern at ee.lbl.gov Fri Apr 30 01:02:39 1999 From: vern at ee.lbl.gov (Vern Paxson) Date: Fri, 30 Apr 1999 01:02:39 PDT Subject: Virtual Memory exceeded In-Reply-To: Your message of Thu, 29 Apr 1999 21:34:12 PDT. Message-ID: <199904300802.BAA15285@daffy.ee.lbl.gov> > We've got some trouble with bro... > After about 2 hours running bro (mt script), bro crash with a : > "Virtual Memory exceeded in 'new'" Error. How large a volume traffic stream are you monitoring? (how many hosts, connections/sec, raw link speed) What filter (bro -F) are you using? > Can someone suggest me what I can do about this (I've already increased > RAM and swap from 32Mb to 64Mb) ? For our environment (5000+ hosts, FDDI link) we run with a lot more memory than that. > Is there a way to check what part of bro is taking whole this memory (stream > buffers or active sessions table, ...) It will mostly be the active sessions. Vern