[Bro] smb crashing workers

[Mike Kolkebeck]

I know the smb analyzer still has a few bugs in Bro-2.1 , but is there any way to prevent/catch the bro workers from infrequently crashing (~2-3 times per day, under peak periods)?
I've included partial output from stderr.log, which I believe is a good representation of each crash output.

Also, probably a dumb question, but when a worker crashes, will it completely stop logging activity until it is restarted (by broctl cron)? I assume so. Would there be any harm in running broctl cron every minute, as opposed to 5 minutes?

Unfortunately I'm not able to identify the cause of the crash, other than bugs in the code, so any guidance or available tools to investigate the cause would also be helpful.

Thanks!
Mike


stderr.log excerpt:
--------------------------
bro: /home/xuser1/bro-2.1/build/src/smb_pac.cc:517: int binpac::SMB::SMB_unicode_string::Parse(const binpac::uint8*, const binpac::uint8*, int): Assertion `t_dataptr_after_s <= t_end_of_data' failed.
/usr/local/bro/share/broctl/scripts/run-bro: line 60: 12342 Aborted                 (core dumped) nohup $mybro $@
listening on eth2, capture length 8192 bytes