[Bro] Stand-alone cluster problems

[Tyler T. Schoenke]

Robin,

I pulled the svn code from 6/15, and got the following error when 
running make:

Generating code for SSLRecordLayerFlow
make  all-am
g++ -DHAVE_CONFIG_H -I. -I..   -I. -I../aux/binpac/lib -I../src -I. -I.. 
   -O -I/usr/local/include -W -Wall -Wno-unused   -g -O2 -MT main.o -MD 
-MP -MF .deps/main.Tpo -c -o main.o main.cc
In file included from Frame.h:11,
                  from main.cc:31:
Val.h:853: error: extra qualification 'TableVal::' on member 'RecursiveSize'
main.cc: In function 'int main(int, char**)':
main.cc:452: warning: deprecated conversion from string constant to 'char*'
*** Error code 1

Am I missing some dependency?

In the meantime, I'll try unloading some of the scripts to drop the 
memory usage.

Thanks,

Tyler


Robin Sommer wrote:
> Hi Tyler,
> 
> a number of thoughts:
> 
> - increasing the BPF buffer sizes is definitly important and should
> generally reduce drops.
> 
> - the top output shows that the Bro process is actually swapping out
> memory to disk:
> 
>>   PID USERNAME    THR PRI NICE   SIZE    RES STATE  C   TIME   WCPU COMMAND
>> 51061 XXXXXX        1 -20    0  1207M   843M swread 1 606:53  0.00%  
> 
> Once that happens, pretty much all bets are off regarding drops: the
> I/O load will dominate everything else and Bro almost certainly drop
> tons of packets.
> 
> - the stack backtrace shows a piece of code where we just found a
> problem in the version checked into my branch, which has the
> potential to cause drops with large tables. I can't tell whether
> it's a coincidence or indeed causing trouble in your case. In any
> case, I've committed a fix, please update your working copy and
> recompile to see whether that makes any difference.
> 
> Robin
>