[Bro] Memory Issue with Bro

[Sampada Kathare]

Hi,

These are the bro workers. I haven't shown the memory usage of the Bro manager and proxy processes. I believe the manager is the one that takes up most of the memory as when I stop the manager, the available free memory goes up by almost 10G! I will send out that log shortly.

Could the manager in anyway be accumulating per worker or per flow state and not freeing it?

Thanks!
-
Sampada

-----Original Message-----
From: Azoff, Justin S [mailto:jazoff at illinois.edu]
Sent: Tuesday, September 29, 2015 8:56 AM
To: Sampada Kathare <skathare at solarflare.com>
Cc: bro at bro.org
Subject: Re: [Bro] Memory Issue with Bro
Importance: High

>
> [root at dellr620c skathare]#top
>
> top - 22:48:06 up 70 days, 19:43,  5 users,  load average: 18.25, 13.49, 10.04
> Tasks:  17 total,   1 running,  16 sleeping,   0 stopped,   0 zombie
> %Cpu(s): 31.5 us,  2.9 sy,  0.7 ni, 43.7 id, 21.1 wa,  0.0 hi,  0.0 si,  0.0 st
> KiB Mem:  32900200 total, 32731868 used,   168332 free,      336 buffers
> KiB Swap:  1953076 total,  1262956 used,   690120 free.    14248 cached Mem
>
>   PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND                                                  P
> 20504 root      20   0  404644  32724   1464 D   0.0  0.1   6:32.62 bro                                                     31
> 20552 root      20   0  404692  50108   1496 D  52.1  0.2   6:37.18 bro                                                     29
> 20564 root      20   0  404824  50960   1508 D  49.8  0.2   6:37.16 bro                                                     27
> 20574 root      20   0  404652  48748   1476 D  52.0  0.1   6:36.52 bro                                                     24
> 20567 root      20   0  404684  49948   1456 D   0.0  0.2   6:33.32 bro                                                     23
> 20561 root      20   0  421440  66672   1412 D  51.9  0.2   6:37.14 bro                                                     18
> 20569 root      20   0  404708  31904   1508 D  41.1  0.1   6:34.77 bro                                                     16
> 20495 root      20   0  404620  49936   1408 D  27.1  0.2   6:34.91 bro                                                     13
> 20515 root      20   0  404684  46324   1500 D  21.9  0.1   6:33.25 bro                                                     13
> 20548 root      20   0  404704  50188   1504 D  43.6  0.2   6:35.16 bro                                                     13
> 20474 root      20   0  404736  32704   1508 D   0.0  0.1   6:32.79 bro                                                     12
> 20502 root      20   0  404636  29300   1464 D  52.0  0.1   6:36.13 bro                                                     12
> 20539 root      20   0  404748  32784   1484 D  44.7  0.1   6:34.08 bro                                                     11
> 20537 root      20   0  404668  29284   1464 D   0.0  0.1   6:32.03 bro                                                      4
> 20559 root      20   0  404684  32644   1444 R  54.6  0.1   6:38.12 bro                                                      3
> 20542 root      20   0  404728  32704   1504 D  25.1  0.1   6:33.84 bro                                                      1
> 20289 root      20   0  196768    412    412 S   0.0  0.0   0:00.03 solar_clusterd                                           0
>

Are those the only bro processes you are running?

the %MEM is only .1 or .2% for all of those process, and even if I round most of them up to .2% that only adds up to 3.2%

Can you press the M key in top to sort by memory usage?
--
- Justin Azoff


The information contained in this message is confidential and is intended for the addressee(s) only. If you have received this message in error, please notify the sender immediately and delete the message. Unless you are an addressee (or authorized to receive for an addressee), you may not use, copy or disclose to anyone this message or any information contained in this message. The unauthorized use, disclosure, copying or alteration of this message is strictly prohibited.