[Bro] accept failed, Too many open files 24

[Azoff, Justin S]

> On Nov 1, 2016, at 4:25 PM, Seth Hall <seth at icir.org> wrote:
> 
> 
>> On Nov 1, 2016, at 11:06 AM, Matt Clemons <matt.clemons at gmail.com> wrote:
>> 
>> Has anyone had to deal with this issue or have some ideas?  Is there some hidden setting in bro where I can set open file limits
> 
> There was an issue with file handles being left open when they weren't needed which will be fixed in 2.5 (and is fixed in the 2.5 beta).  Also, in 2.5 you can run a cluster with a dedicated "logger" node which should improve some of the cluster behavior with such a large cluster.
> 
> I would recommend jumping in and trying out the beta.  

The 2 file descriptor leakage fixes were committed just after the 2.5 beta was released

commit 520ed43eae4ce7bcd8bb22cfd9cb6d138c4a4fd7
Author: Daniel Thayer <dnthayer at illinois.edu>
Date:   Wed Aug 31 16:30:10 2016 -0500

    Added another missing fclose in scan.l

commit b3a7d07e66b027a56e57ba010998639ff0d6da86
Author: Daniel Thayer <dnthayer at illinois.edu>
Date:   Wed Aug 31 14:07:44 2016 -0500



-- 
- Justin Azoff