[Bro] misc-stats question

erik clark philosnef at gmail.com
Thu Sep 29 05:50:03 PDT 2016


In misc-stats, we have a field in stats.lg labeled "plt_lag". What exactly
is this measuring? Also, in a reasonable deployment, what should we see as
far as events_queued. Should this be close to zero? I am seeing a packet
lag of 2.0-2.5, and several million events queued.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160929/473d8e7e/attachment.html 


More information about the Bro mailing list