[Bro] Bro crashed this morning..

Jan Grashöfer jan.grashoefer at gmail.com
Tue Oct 25 02:32:07 PDT 2016


> Hmm, that kinda makes sense.
> Disabled the cron job of restart-bro, and will keep a check on bro on
> manager for future.

While Bro should pick up new intel without a restart, 2.4.1 will never
delete any intel that has been ingested. If you are using large volatile
feeds that might become a problem. With 2.5 the intel framework allows
to expire intel. I would be curious to know if you are experiencing any
corresponding problems with 2.4.1.

Jan


More information about the Bro mailing list