[Bro] out of memory after a couple days?

[Bernhard Amann]

Hi,

the fix in BIT-1103 only applies to you if you are extensively using the input
framework to read events — e.g. by using the intelligence framework and updating
it regularly.

If you do not use the Input framework to import data into Bro, this fix will
change nothing. It also should not change memory on any worker nodes (the
input framework usually is only used on the master).

Bernhard

On Dec 11, 2013, at 10:34 PM, Gary Faulkner <gary at doit.wisc.edu> wrote:

> I came across BIT-1103 regarding a memory leak affecting Bro 2.2 in JIRA 
> which appears to have been resolved recently. Any chance that ticket and 
> fix has relevance to the discussion from last week concerning gradual 
> memory exhaustion in Bro 2.2?
> 
> Regards,
> Gary
> 
> On 12/4/2013 10:31 PM, Seth Hall wrote:
>> 
>> On Dec 4, 2013, at 10:34 PM, Mike Patterson <mike.patterson at uwaterloo.ca> wrote:
>> 
>>> I think you’re definitely running into a memory leak. I’ve had 2.2 processes try to grab up to 100GB of RAM. 8 workers, 96GB of RAM, but the box splits time with another 8 snort workers. My late 2.1 release (september 21 IIRC) was quite a bit more stable.
>> 
>> 
>> I think there is some particular traffic that you guys are running into that's causing it.  A few other people have encountered that too but we haven't been able to nail down what it is yet.
>> 
>>   .Seth
>> 
>> --
>> Seth Hall
>> International Computer Science Institute
>> (Bro) because everyone has a network
>> http://www.bro.org/
>> 
> 
> -- 
> Gary Faulkner
> UW Madison
> Office of Campus Information Security
> 608-262-8591
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro