[Bro] Bro Memory Consumtion

[Justin Azoff]

On Mon, Feb 22, 2010 at 10:48:39AM -0500, Powell, Scott wrote:
> Bro Gurus,
> 
> I am having an issue with Bro and memory exhaustion.
..
> I am running a large number of scripts from Seth Hall's script repository in
> addition to the ones that are enabled by default. Below are the policies I'm
> loading in local.bro:

Hi all, following up on this..

4 days ago I merged my bro policy with the latest updates from Seth, and
since then the memory usage on my bro machine has flatlined(it used to look
like a sawtooth wave from being restarted all the time).  I'm not sure what the
cause was, but my guess is something to do with the http file identification.
The latest version of the script uses bro signatures instead of libmagic for
file identification.  I wonder if the libmagic code has a memory leak in it
somewhere?

If you are still having memory problems it would be really interesting to
see if updating fixes things for you as well.


-- 
-- Justin Azoff
-- Network Security & Performance Analyst