[Bro] Bro crash with "bro: out of memory in new"

[Seth Hall]

On Jul 15, 2008, at 11:30 AM, Gregory Brown wrote:

> I am getting crashes with the title "bro: out of memory in new".
> I am sending the debuger output for one of these crashes. Please  
> advise any
> further information needed.

Your host ran out of memory :)

There are a couple of ways that I know of to compensate for this  
happening regularly.  You can run a Bro cluster which spreads a good  
deal of the memory load across all of the machines in the cluster or  
you can run the prof.bro script and watch for the output of the global  
variable sizes in the prof.log file and subsequently tune your  
analysis to not store so much state.

  .Seth

---
Seth Hall
Network Security - Office of the CIO
The Ohio State University
Phone: 614-292-9721