[Bro] Version: 2.0-907 -- Bro manager memory exhaustion

[Tritium Cat]

On Tue, Jul 31, 2012 at 3:11 PM, Robin Sommer <robin at icir.org> wrote:

(...)


> > After starting bro, the manger continually consumes memory until system
> > exhaustion (64GB).  The CPU usage is high as well.
>
> That's not a good sign for the manager ... It's possible that we have
> a memory leak in there. Has it worked better with 2.0? (If you have
> tried that?)
>
>
I had the same problem with earlier development builds and 2.0 but the
exhaustion was not as rapid.  I suspect the number of peers has some
influence in triggering or accelerating a leak.



> > Another problem is over 50% of the workers consume 100% CPU.  This is
> very
> > odd considering the low volume traffic between 400-1000 Mbps per node.
>
> So that's 400-1000 Mbps divided by 20 workers processes? I'll let
> other's chime in here, not really sure what to expect with PF_RING in
> that setup.
>
>
I based the design on the very rough suggestion each core will handle
60-120 Mbps of traffic.  So 20 workers on a 48 core would be 1.2 Gbps to
2.4 Gbps.  I want to say I even recall reading about that threshold in a
paper somewhere.

--TC
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20120731/aa6f751d/attachment.html