[Bro] Memory Usage

Robin Sommer robin at icir.org
Fri Mar 14 16:25:35 PDT 2008


On Fri, Mar 14, 2008 at 12:16 -0700, Joel Ebrahimi wrote:

> I have been testing Bro 1.2.1 and the current 1.3.2. In both cases over time
> the memory is eventaully exhausted.

In general that can have a number of reasons. An internal memory
leak is one of them but not necessarily the most likely.

The best thing to do first is loading profile.bro. It will produce
an output file prof.log containing regular snapshots of the amount
of state stored inside various of Bro's components. Admittedly,
prof.log is a bit cryptic; feel free to send me a copy if you need
help interpreting it. 

One very typical problem is that one of the script-level variables
gets large. If that is the case, the variable should show up in
prof.log in the sections starting with "Global_sizes > 100k".  The
memory amounts given there are only very rough estimates but
generally the big hitters in terms of script-level state will show
up. 

That said, a few leaks have been fixed since 1.3.2. Try the current
trunk to see if it changes anything; one or two more are fixed in my
development branch (see
http://www.bro-ids.org/wiki/index.php/Subversion#Public_Access for
how to get the code out of the Subversion repository). 

Robin

-- 
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org



More information about the Bro mailing list