[Bro] Logger Child Memory Leak (logger crashing often)

Ryan Leonard rleonar7 at uoregon.edu
Fri Jan 13 11:42:18 PST 2017


Hey Justin,

The results of running top (the "-o TIME" parameter set was unavailable on my system)

# top -b -n 1 -H | fgrep bro: | head -n 20
48059 root      20   0 4496m 4.0g 260m S 27.7  1.7  38:36.49 bro: conn/Log::
47908 root      20   0 4496m 4.0g 260m S  5.5  1.7   8:29.99 bro: weird/Log:
47911 root      20   0 4496m 4.0g 260m S  5.5  1.7   8:32.29 bro: dns/Log::W
47907 root      20   0 4496m 4.0g 260m S  1.8  1.7   4:36.68 bro: syslog/Log
10331 root      20   0 19.1g  15g 257m S  0.0  6.7   0:06.92 bro: /opt/bro/f
29622 root      20   0  134m  59m 5396 S  0.0  0.0   0:00.10 bro: loaded_scr
29634 root      20   0  593m 520m 5444 S  0.0  0.2   0:00.12 bro: loaded_scr
29624 root      20   0  175m  59m 5476 S  0.0  0.0   0:00.26 bro: /opt/bro/f
29632 root      20   0  175m  59m 5476 S  0.0  0.0   0:00.19 bro: loaded_scr
47901 root      20   0 4496m 4.0g 260m S  0.0  1.7   0:00.15 bro: packet_fil
47903 root      20   0 4496m 4.0g 260m S  0.0  1.7   0:00.07 bro: loaded_scr
47904 root      20   0 4496m 4.0g 260m S  0.0  1.7   0:00.06 bro: reporter/L
47905 root      20   0 4496m 4.0g 260m S  0.0  1.7   0:00.26 bro: communicat
47906 root      20   0 4496m 4.0g 260m S  0.0  1.7   0:00.08 bro: stats/Log:
47909 root      20   0 4496m 4.0g 260m S  0.0  1.7   0:00.76 bro: known_serv
47910 root      20   0 4496m 4.0g 260m S  0.0  1.7   0:00.30 bro: known_host
47912 root      20   0 4496m 4.0g 260m S  0.0  1.7   0:00.88 bro: software/L
47913 root      20   0 4496m 4.0g 260m S  0.0  1.7   0:00.07 bro: dce_rpc/Lo
47914 root      20   0 4496m 4.0g 260m S  0.0  1.7   0:03.22 bro: files/Log:
47915 root      20   0 4496m 4.0g 260m S  0.0  1.7   0:10.19 bro: http/Log::

For some more information -- the processors we are running are the following:
# lstopo -v | grep Socket
    Socket L#0 (P#0 CPUModel="Intel(R) Xeon(R) CPU E5-2670 v2 @ 2.50GHz" CPUType=x86_64)
    Socket L#1 (P#1 CPUModel="Intel(R) Xeon(R) CPU E5-2670 v2 @ 2.50GHz" CPUType=x86_64)

Hyper threading is disabled on this server.

Thanks!
-Ryan




More information about the Bro mailing list