[Bro] Memory Consumption

[Jason Batchelor]

> At least memory upgrades are just about the cheapest and easiest upgrade
you could possibly do with your system. :)
Very true indeed :)

> Bro typically does consume quite a bit of memory and you're a bit tight
on memory for the number of workers you're running.
Curious what would you recommend for just bro itself? Double, triple this?

> A common problem is that sometimes there will be state tables that grow
too large. If you load misc/profiling then you should have a prof.log in
each of your processes spool directories (they don't log centrally like
other logs). Every so often in there will be an indication of the largest
global variables and you can look at that for a start to see if some script
is just holding on to more state than you'd like it to.

I will definately take a look, thanks for the info!



On Thu, Jun 26, 2014 at 11:28 AM, Seth Hall <seth at icir.org> wrote:

>
> On Jun 26, 2014, at 11:12 AM, Jason Batchelor <jxbatchelor at gmail.com>
> wrote:
>
> > What is going on here? Is it normal for Bro to take up as much memory as
> it can? Are others experiancing this too? Is there something I can do to
> restrict Bro from being such a memory hog?
>
> Bro typically does consume quite a bit of memory and you're a bit tight on
> memory for the number of workers you're running.
>
> A common problem is that sometimes there will be state tables that grow
> too large.  If you load misc/profiling then you should have a prof.log in
> each of your processes spool directories (they don't log centrally like
> other logs).  Every so often in there will be an indication of the largest
> global variables and you can look at that for a start to see if some script
> is just holding on to more state than you'd like it to.
>
> > I was considering getting more memory for the servers, however based on
> these tests I cannot be certain Bro will not just run away with the new
> memory I give it in the same fashion :)
>
> At least memory upgrades are just about the cheapest and easiest upgrade
> you could possibly do with your system. :)
>
>   .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140626/524ee203/attachment.html