[Bro] question about intel files

[philosnef]

             total       used       free     shared    buffers     cachedMem:        371336     340383      30952          0        300     111823-/+ buffers/cache:     228259     143076 Swap:        15999        191      15808 
 

    On Wednesday, August 3, 2016 9:59 AM, "Azoff, Justin S" <jazoff at illinois.edu> wrote:
 

 
> On Aug 3, 2016, at 9:56 AM, philosnef <philosnef at yahoo.com> wrote:
> 
> With  hyperthreading that's actually 40 cores, not 20. Running 20 workers with 40 cores available should be more than sufficient. At the time brotop was run, 355 out of 390 gigs of ram are in use. The only things running on this box are bro, and a splunk forwarder. The splunk forwarder is only using about 15 gigs of ram. This excessive memory consumption is on all of our bro boxes, no matter the input stream. Even on boxes only getting 500Mb/s, we see this memory creep until it is exhausted. At no point is oomkiller called however, so it is not exceeding available memory, just consuming all of the available memory.

Can you show the output of

free -m


-- 
- Justin Azoff


   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160803/4870c1b3/attachment.html