[Bro] Manager swapping..

[Johanna Amann]

Oh, that is interesting.

Just to check - this was on 2.5?

Would you potentially be up for a little bit of digging to see what is
causing this? I am not aware of anyone encountering this problem before,
and I really would like this not to happen :)

If you are ok with it, I will supply you with an instrumented version of
the validation script that outputs a bit of debugging information to help
me check what is going on here.

Johanna

On Thu, Mar 23, 2017 at 03:40:32PM +0000, Hovsep Levi wrote:
> Try disabling the SSL/TLS cert verification.  I'm not sure why but
> that helped, without it the manager would slowly climb to massive
> memory usage.  Now it works fine for one or two weeks before
> unexpectedly using all memory.
> 
> #@load protocols/ssl/validate-certs
> 
> Good:
> 
> Name         Type    Host             Pid     Proc    VSize  Rss  Cpu   Cmd
> logger-1     logger  10.1.1.1   6241    parent  701M   163M  20%  bro
> logger-1     logger  10.1.1.1   6261    child   458M    69M   3%  bro
> manager      manager 10.1.1.1   6345    child   510M   377M 100%  bro
> manager      manager 10.1.1.1   6292    parent  890M   804M  24%  bro
> 
> 
> Bad:
> 
> Name         Type    Host             Pid     Proc    VSize  Rss  Cpu   Cmd
> logger-1     logger  10.1.1.1   52731   parent    1G   806M   0%  bro
> logger-1     logger  10.1.1.1   52951   child     8G     8G   0%  bro
> manager      manager 10.1.1.1   53127   child     1G   742M   0%  bro
> manager      manager 10.1.1.1   52979   parent  1573G  100G   0%  bro
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>