making bro produce a message when it crashes?

Robin Sommer sommer at in.tum.de
Tue Mar 18 00:53:21 PST 2003


On Mon, Mar 17, 2003 at 17:04 -0500, Anton Chuvakin, Ph.D. wrote:

> Does anybody know how to make bro produce whatever debugging
> messages when it crashes (maybe even a core file)? In my case it
> always crashes after 2-7 days of running but I have no way of
> figuring out how to figure out what killed it.

Did you keep an eye on Bro's memory usage? To my experience, if Bro
crashes regularly after running quite some time (hours to several
days, depending on the amount and nature of the traffic), it is most
of the time due to running out of memory. Loading reduce-memory.bro
helps a lot, but in our case I needed to tweak some additional
things as well (in particular setting timeouts on script-level
tables to expire old state). In an upcoming version, Bro will
probably give a more informational message if it runs out of memory.

Robin

-- 
Robin Sommer * Room        01.08.055 * www.net.in.tum.de
TU Munich    * Phone (089) 289-18006 *  sommer at in.tum.de 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20030318/15d58995/attachment.bin 


More information about the Bro mailing list