[Bro] Memory Consumption

[Seth Hall]

On Jun 26, 2014, at 11:12 AM, Jason Batchelor <jxbatchelor at gmail.com> wrote:

> What is going on here? Is it normal for Bro to take up as much memory as it can? Are others experiancing this too? Is there something I can do to restrict Bro from being such a memory hog?

Bro typically does consume quite a bit of memory and you're a bit tight on memory for the number of workers you're running.  

A common problem is that sometimes there will be state tables that grow too large.  If you load misc/profiling then you should have a prof.log in each of your processes spool directories (they don't log centrally like other logs).  Every so often in there will be an indication of the largest global variables and you can look at that for a start to see if some script is just holding on to more state than you'd like it to.

> I was considering getting more memory for the servers, however based on these tests I cannot be certain Bro will not just run away with the new memory I give it in the same fashion :)

At least memory upgrades are just about the cheapest and easiest upgrade you could possibly do with your system. :)

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140626/46d49005/attachment.bin