[Bro] Packet loss during log rotation

[Seth Hall]

On Sep 23, 2014, at 2:14 PM, Damian Gerow <damian.gerow at shopify.com> wrote:

> I'm trying to set up a new standalone Bro instance, but I seem to be experiencing regular packet loss.  The host is processing minimal traffic -- always <10Mbps, usually around 2Mbps -- but I've noticed that the packet loss almost always occurs at time of log rotation.

Are you running in cluster mode or standalone?  If you're running in standalone, it's very possible that something is blocking briefly when the logs are rotated which could cause a small back up of packets, leading to loss.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/