[Bro] question: memory requirements of tables

[Holger Dreger]

Hi Christoph,

On Tue, Feb 15, 2005 at 10:32:21AM +0100, Christoph Goeldi wrote:
> i noticed that my bro (version 0.9a8.17) eats up my memory.
> even with the reduce-memory.bro script it needed up to 2GB
> or more after a while and swapped all the time.
> when we reduced the traffic the memory usage decreased only
> a little bit, but remained very high.

Have you verified that the memory is indeed consumed by your scripts?
Just load the profiling policy script. It outputs some very useful
resource consumption logs. The only problem: you do not want to run it
online "in operative mode" since it causes bro to use lots of CPU
every time it generates its statistics. But anyway, it works for
debugging purposes.

> because we use &*_expire tags and scheduler to keep tables
> small, we tried to reproduce our problem with a small script:
> ... 
> the following is the output of our script when doing some udp scanning.
> this logs shows that all entries in the table have been deleted, but the
> table uses still a lot of memory! what happened.

mmmh, I'm really not sure whether what you see in your script is
really your problem of running out of memory. The table first grows
but then again shrinks (0->4M->1.5M). I think that suggests that there
is not really a larger problem with table expiration.

Hope this helps,
	Holger