[Bro] Bro Memory Consumtion

[Seth Hall]

On Mar 18, 2010, at 9:25 AM, Powell, Scott wrote:

> I synced my scripts up with the latest and greatest from Seth's  
> repository but am still seeing Bro consume all 16gb of memory after  
> only an hour or two. When time permits I will try to debug further  
> to see if I can narrow it down to a particular script/policy.


If it's using that much memory that quickly, my guess would be that  
there is a state table growing out of control.  Load the "profiling"  
script, it will print out globals sizes every 20 minutes or so in a  
file named prof.log, then and you'll be able to see what variable(s)  
is/are so huge.

If you are able to find out what variable is causing the memory  
consumption issue, please reply and let us know.  It may be an issue  
that needs to be resolved or at least addressed in some way.

   .Seth

---
Seth Hall
Network Security - Office of the CIO
The Ohio State University
Phone: 614-292-9721