[Bro] Bro2 Random Crashes

[Gregor Maier]

On 3/1/12 6:32 , Nicholas Weaver wrote:
>
>
> On Mar 1, 2012, at 6:02 AM, Chris Crawford wrote:
>> The only thing I've been able to key in on, is that over time Bro2
>> eventually causes all free memory in Ubuntu to change to cached
>> memory.  From the Citrix Xen Console, that cached memory shows up as
>> used memory.  So, maybe Xen interprets cached memory as being used?
>> Also -- when Xen senses that most of the memory is "used" (but,
>> really, it's cached inside Ubuntu), the percent utilization in one of
>> the CPUs in the VM spikes.  After Bro2 crashes, CPU utilization
>> returns to normal, but memory is never freed -- it remains cached
>> forever.
>
> Cached memory IS used memory by the OS.  Modern operating systems are very aggressive about using all available "physical" memory as a disk cache when otherwise not being used, especially Linux variants.  But at the same time, it should also aggressively evict those entries when it think that there are limits on physical memory. [1]

Indeed. I found in several other cases that Linux caching strategy can 
be really annoying. I'm regularly having performance problem on with 
high throughput workloads....



cu
Gregor