[Bro] troubleshooting bro memory usage?

[aaron gee-clough]

On 08/11/2013 09:02 PM, Vlad Grigorescu wrote:
> On Aug 11, 2013, at 8:39 AM, Aaron Gee-Clough <lists at g-clef.net> wrote:
>
>> I have two vanilla
>> securityonion installs (no custom .bro scripts added, just the ones that
>> came with securityonion), watching just traffic to two different DNS
>> resolvers
> What traffic rate do you see?

95th percentile over a week (according to MRTG): Box 1: 34.6 Mbps. Box 
2: 28Mbps

>
>> right now one of the worker parent processes (according to
>> "broctl top") on each securityonion box grows monotonically in RAM usage
>> until it gets killed by Linux (and is then restarted by broctl's cron job).
> How much RAM is in the box?
>
16 GB. Both have 6-core 2.2GHz CPUs, also.

Thanks.

aaron