[Bro] question about intel files

[philosnef]

Because, on boxes where we arent consistently rebooting bro, we are having oomkiller nuking splunk and bro. 

    On Wednesday, August 3, 2016 10:39 AM, "Azoff, Justin S" <jazoff at illinois.edu> wrote:
 

 
> On Aug 3, 2016, at 10:33 AM, philosnef <philosnef at yahoo.com> wrote:
> 
> This was about 2 hours after Bro was rebooted. Here is the output of a bro box with nearly identical throughput that has had bro up and running for the past 48 hours. As you can see, the buffer at this rate has shot up to 4g per parent. If I did not reboot the first box reported every 8 hours or so, we would see the same result there.
> 
> $ free -m
>              total      used      free    shared    buffers    cached
> Mem:        387495    375736      11758          0      1073    248216
> -/+ buffers/cache:    126446    261048
> Swap:        15999        267      15732

This box has 256G of ram free.

I'm sorry but I just don't see where you have a problem here.

-- 
- Justin Azoff


  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160803/73865e17/attachment.html