[Bro] Bro Memory Consumtion

[Powell, Scott]

Seth,

Yes, I did include '--enable-brov6' because we are getting ready to rollout IPv6 in or perimeter and I was also seeing messages from Bro that it was not compiled with IPv6 support (via "broctl diag").

Here are all the parameters passed to configure:

$ ./configure --prefix=/var/local/bro-1.5.1 --enable-cluster --enable-int64 --enable-brov6 --no-create --no-recursion

-Scott

-----Original Message-----
From: Seth Hall [mailto:hall.692 at osu.edu] 
Sent: Tuesday, March 23, 2010 9:39 PM
To: Powell, Scott
Cc: Justin Azoff; bro at ICSI.Berkeley.EDU
Subject: Re: [Bro] Bro Memory Consumtion


On Mar 19, 2010, at 1:50 PM, Powell, Scott wrote:

> My memory consumption is better but still growing and not shrinking.  
> I've been examining the globals in the prof.log files for each of  
> the various components (workers, manager, etc.) but am not sure what  
> is causing so much memory to be allocated. Below is an example from  
> one of my workers. There is ~3.6GB of memory allocated, total, but  
> the globals are only 214MB.

Your issue has been nagging me the past few days because I couldn't  
explain why your memory use is so high.  Today I finally realized what  
it could be.  Did you provide the '--enable-brov6' flag when you built  
Bro?  Even more worthwhile, could you provide the full configure line  
you used when you built Bro?  (it's in the config.log file in the  
directory extracted from the tar.gz)

   .Seth

---
Seth Hall
Network Security - Office of the CIO
The Ohio State University
Phone: 614-292-9721