[Bro] intel.log file stops getting generated.
fatema bannatwala
fatema.bannatwala at gmail.com
Wed Jan 25 10:02:59 PST 2017
Forgot to mention about the arch. of cluster:
1 manager node (which is defined as logger as well)
4 worker nodes (which are defined as proxies as well)
Before (in 2.4.1) we used to have manager act as proxy, but because of
performance issue (i.e bro unable to rotate logs on manager), moved the
proxy functionality to the workers.
Attaching the output of 'broctl top', as it will swamp this email with text
if pasted in the body :-)
Thanks,
Fatema
On Wed, Jan 25, 2017 at 12:47 PM, Azoff, Justin S <jazoff at illinois.edu>
wrote:
> > On Jan 25, 2017, at 12:45 PM, fatema bannatwala <
> fatema.bannatwala at gmail.com> wrote:
> >
> > Hi Justin,
> >
> > Thanks for suggestions.
> > Here are the stats (Looks like bro using pf_ring correctly though):
>
> Yes.. that is how it should look.. very important to verify that before
> checking anything else :-)
>
> What does your 'broctl top' output look like?
>
> That will break things down by each process
>
> --
> - Justin Azoff
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170125/9cdf2be4/attachment-0001.html
-------------- next part --------------
Name Type Host Pid Proc VSize Rss Cpu Cmd
logger logger manager.xx.xx.xx 22042 parent 2G 145M 18% bro
logger logger manager.xx.xx.xx 22059 child 354M 295M 6% bro
manager manager manager.xx.xx.xx 22115 parent 3G 2G 6% bro
manager manager manager.xx.xx.xx 22134 child 1G 303M 0% bro
proxy-1 proxy wrk1.xx.xx.xx 78639 child 212M 72M 25% bro
proxy-1 proxy wrk1.xx.xx.xx 78638 parent 1G 1G 12% bro
proxy-2 proxy wrk2.xx.xx.xx 76757 child 212M 73M 18% bro
proxy-2 proxy wrk2.xx.xx.xx 76756 parent 1G 1G 6% bro
proxy-3 proxy wrk3.xx.xx.xx 74756 child 212M 47M 31% bro
proxy-3 proxy wrk3.xx.xx.xx 74755 parent 1G 1G 6% bro
proxy-4 proxy wrk4.xx.xx.xx 63611 child 212M 50M 12% bro
proxy-4 proxy wrk4.xx.xx.xx 63610 parent 1G 1G 0% bro
worker-1-1 worker wrk1.xx.xx.xx 78985 parent 5G 5G 18% bro
worker-1-1 worker wrk1.xx.xx.xx 79003 child 429M 269M 0% bro
worker-1-10 worker wrk1.xx.xx.xx 78976 parent 5G 5G 6% bro
worker-1-10 worker wrk1.xx.xx.xx 78999 child 428M 269M 0% bro
worker-1-11 worker wrk1.xx.xx.xx 78977 parent 5G 5G 12% bro
worker-1-11 worker wrk1.xx.xx.xx 78995 child 429M 269M 0% bro
worker-1-12 worker wrk1.xx.xx.xx 78972 parent 5G 5G 6% bro
worker-1-12 worker wrk1.xx.xx.xx 78994 child 428M 269M 0% bro
worker-1-13 worker wrk1.xx.xx.xx 78981 parent 5G 5G 12% bro
worker-1-13 worker wrk1.xx.xx.xx 79024 child 430M 269M 0% bro
worker-1-14 worker wrk1.xx.xx.xx 78984 parent 5G 5G 31% bro
worker-1-14 worker wrk1.xx.xx.xx 79037 child 429M 269M 0% bro
worker-1-15 worker wrk1.xx.xx.xx 78978 parent 5G 5G 18% bro
worker-1-15 worker wrk1.xx.xx.xx 79031 child 428M 269M 0% bro
worker-1-16 worker wrk1.xx.xx.xx 78992 parent 5G 5G 100% bro
worker-1-16 worker wrk1.xx.xx.xx 79034 child 428M 268M 0% bro
worker-1-17 worker wrk1.xx.xx.xx 78979 parent 5G 5G 6% bro
worker-1-17 worker wrk1.xx.xx.xx 79025 child 429M 268M 0% bro
worker-1-18 worker wrk1.xx.xx.xx 78983 parent 5G 5G 12% bro
worker-1-18 worker wrk1.xx.xx.xx 79027 child 429M 269M 0% bro
worker-1-19 worker wrk1.xx.xx.xx 78991 parent 5G 5G 18% bro
worker-1-19 worker wrk1.xx.xx.xx 79035 child 428M 268M 0% bro
worker-1-2 worker wrk1.xx.xx.xx 78973 parent 5G 5G 12% bro
worker-1-2 worker wrk1.xx.xx.xx 79033 child 428M 269M 0% bro
worker-1-20 worker wrk1.xx.xx.xx 78987 parent 5G 5G 12% bro
worker-1-20 worker wrk1.xx.xx.xx 79008 child 429M 269M 0% bro
worker-1-21 worker wrk1.xx.xx.xx 78989 parent 5G 5G 12% bro
worker-1-21 worker wrk1.xx.xx.xx 79026 child 429M 269M 0% bro
worker-1-22 worker wrk1.xx.xx.xx 78974 parent 5G 5G 12% bro
worker-1-22 worker wrk1.xx.xx.xx 78998 child 429M 269M 0% bro
worker-1-3 worker wrk1.xx.xx.xx 78986 parent 5G 5G 6% bro
worker-1-3 worker wrk1.xx.xx.xx 79029 child 428M 268M 0% bro
worker-1-4 worker wrk1.xx.xx.xx 78982 parent 5G 5G 25% bro
worker-1-4 worker wrk1.xx.xx.xx 79036 child 429M 269M 0% bro
worker-1-5 worker wrk1.xx.xx.xx 78975 parent 5G 5G 12% bro
worker-1-5 worker wrk1.xx.xx.xx 78997 child 428M 268M 0% bro
worker-1-6 worker wrk1.xx.xx.xx 78993 parent 5G 5G 12% bro
worker-1-6 worker wrk1.xx.xx.xx 79028 child 429M 269M 0% bro
worker-1-7 worker wrk1.xx.xx.xx 78990 parent 5G 5G 12% bro
worker-1-7 worker wrk1.xx.xx.xx 79032 child 429M 269M 0% bro
worker-1-8 worker wrk1.xx.xx.xx 78980 parent 5G 5G 12% bro
worker-1-8 worker wrk1.xx.xx.xx 78996 child 429M 268M 0% bro
worker-1-9 worker wrk1.xx.xx.xx 78988 parent 5G 5G 56% bro
worker-1-9 worker wrk1.xx.xx.xx 79030 child 428M 268M 0% bro
worker-2-1 worker wrk2.xx.xx.xx 77108 parent 5G 5G 18% bro
worker-2-1 worker wrk2.xx.xx.xx 77154 child 430M 271M 0% bro
worker-2-10 worker wrk2.xx.xx.xx 77102 parent 5G 5G 12% bro
worker-2-10 worker wrk2.xx.xx.xx 77140 child 429M 270M 0% bro
worker-2-11 worker wrk2.xx.xx.xx 77090 parent 5G 5G 12% bro
worker-2-11 worker wrk2.xx.xx.xx 77115 child 430M 270M 0% bro
worker-2-12 worker wrk2.xx.xx.xx 77091 parent 5G 5G 12% bro
worker-2-12 worker wrk2.xx.xx.xx 77116 child 430M 270M 0% bro
worker-2-13 worker wrk2.xx.xx.xx 77106 parent 5G 5G 37% bro
worker-2-13 worker wrk2.xx.xx.xx 77146 child 430M 270M 0% bro
worker-2-14 worker wrk2.xx.xx.xx 77104 parent 5G 5G 62% bro
worker-2-14 worker wrk2.xx.xx.xx 77147 child 430M 269M 6% bro
worker-2-15 worker wrk2.xx.xx.xx 77098 parent 5G 5G 12% bro
worker-2-15 worker wrk2.xx.xx.xx 77144 child 434M 272M 0% bro
worker-2-16 worker wrk2.xx.xx.xx 77109 parent 5G 5G 12% bro
worker-2-16 worker wrk2.xx.xx.xx 77143 child 430M 270M 6% bro
worker-2-17 worker wrk2.xx.xx.xx 77100 parent 5G 5G 18% bro
worker-2-17 worker wrk2.xx.xx.xx 77141 child 429M 269M 0% bro
worker-2-18 worker wrk2.xx.xx.xx 77095 parent 5G 5G 18% bro
worker-2-18 worker wrk2.xx.xx.xx 77153 child 429M 269M 0% bro
worker-2-19 worker wrk2.xx.xx.xx 77111 parent 5G 5G 18% bro
worker-2-19 worker wrk2.xx.xx.xx 77150 child 430M 270M 0% bro
worker-2-2 worker wrk2.xx.xx.xx 77105 parent 5G 5G 25% bro
worker-2-2 worker wrk2.xx.xx.xx 77155 child 429M 270M 0% bro
worker-2-20 worker wrk2.xx.xx.xx 77094 parent 5G 5G 12% bro
worker-2-20 worker wrk2.xx.xx.xx 77152 child 430M 270M 0% bro
worker-2-21 worker wrk2.xx.xx.xx 77096 parent 5G 5G 12% bro
worker-2-21 worker wrk2.xx.xx.xx 77149 child 430M 271M 0% bro
worker-2-22 worker wrk2.xx.xx.xx 77101 parent 5G 5G 18% bro
worker-2-22 worker wrk2.xx.xx.xx 77142 child 429M 270M 0% bro
worker-2-3 worker wrk2.xx.xx.xx 77099 parent 5G 5G 25% bro
worker-2-3 worker wrk2.xx.xx.xx 77148 child 430M 270M 0% bro
worker-2-4 worker wrk2.xx.xx.xx 77093 parent 5G 5G 18% bro
worker-2-4 worker wrk2.xx.xx.xx 77157 child 430M 269M 0% bro
worker-2-5 worker wrk2.xx.xx.xx 77107 parent 5G 5G 12% bro
worker-2-5 worker wrk2.xx.xx.xx 77117 child 429M 269M 6% bro
worker-2-6 worker wrk2.xx.xx.xx 77092 parent 5G 5G 18% bro
worker-2-6 worker wrk2.xx.xx.xx 77158 child 429M 270M 0% bro
worker-2-7 worker wrk2.xx.xx.xx 77110 parent 5G 5G 18% bro
worker-2-7 worker wrk2.xx.xx.xx 77151 child 430M 270M 0% bro
worker-2-8 worker wrk2.xx.xx.xx 77097 parent 5G 5G 18% bro
worker-2-8 worker wrk2.xx.xx.xx 77156 child 430M 270M 6% bro
worker-2-9 worker wrk2.xx.xx.xx 77103 parent 5G 5G 12% bro
worker-2-9 worker wrk2.xx.xx.xx 77145 child 429M 269M 0% bro
worker-3-1 worker wrk3.xx.xx.xx 74969 parent 5G 5G 18% bro
worker-3-1 worker wrk3.xx.xx.xx 75141 child 429M 270M 0% bro
worker-3-10 worker wrk3.xx.xx.xx 74968 parent 5G 5G 12% bro
worker-3-10 worker wrk3.xx.xx.xx 75139 child 427M 268M 0% bro
worker-3-11 worker wrk3.xx.xx.xx 75076 parent 5G 5G 12% bro
worker-3-11 worker wrk3.xx.xx.xx 75112 child 429M 269M 0% bro
worker-3-12 worker wrk3.xx.xx.xx 74966 parent 5G 5G 12% bro
worker-3-12 worker wrk3.xx.xx.xx 75111 child 430M 270M 0% bro
worker-3-13 worker wrk3.xx.xx.xx 74970 parent 5G 5G 18% bro
worker-3-13 worker wrk3.xx.xx.xx 75143 child 429M 269M 0% bro
worker-3-14 worker wrk3.xx.xx.xx 74977 parent 5G 5G 12% bro
worker-3-14 worker wrk3.xx.xx.xx 75128 child 428M 268M 6% bro
worker-3-15 worker wrk3.xx.xx.xx 75102 parent 5G 5G 18% bro
worker-3-15 worker wrk3.xx.xx.xx 75154 child 430M 270M 0% bro
worker-3-16 worker wrk3.xx.xx.xx 74998 parent 5G 5G 12% bro
worker-3-16 worker wrk3.xx.xx.xx 75140 child 429M 270M 0% bro
worker-3-17 worker wrk3.xx.xx.xx 75001 parent 5G 5G 18% bro
worker-3-17 worker wrk3.xx.xx.xx 75113 child 429M 270M 0% bro
worker-3-18 worker wrk3.xx.xx.xx 75026 parent 5G 5G 18% bro
worker-3-18 worker wrk3.xx.xx.xx 75152 child 429M 270M 0% bro
worker-3-19 worker wrk3.xx.xx.xx 75027 parent 5G 5G 18% bro
worker-3-19 worker wrk3.xx.xx.xx 75151 child 430M 269M 0% bro
worker-3-2 worker wrk3.xx.xx.xx 75042 parent 5G 5G 18% bro
worker-3-2 worker wrk3.xx.xx.xx 75114 child 429M 270M 0% bro
worker-3-20 worker wrk3.xx.xx.xx 75051 parent 5G 5G 12% bro
worker-3-20 worker wrk3.xx.xx.xx 75148 child 429M 270M 0% bro
worker-3-21 worker wrk3.xx.xx.xx 75040 parent 5G 5G 25% bro
worker-3-21 worker wrk3.xx.xx.xx 75142 child 429M 269M 0% bro
worker-3-22 worker wrk3.xx.xx.xx 75107 parent 5G 5G 18% bro
worker-3-22 worker wrk3.xx.xx.xx 75145 child 429M 270M 0% bro
worker-3-3 worker wrk3.xx.xx.xx 75072 parent 6G 5G 18% bro
worker-3-3 worker wrk3.xx.xx.xx 75153 child 430M 270M 0% bro
worker-3-4 worker wrk3.xx.xx.xx 75077 parent 5G 5G 18% bro
worker-3-4 worker wrk3.xx.xx.xx 75144 child 429M 268M 0% bro
worker-3-5 worker wrk3.xx.xx.xx 75110 parent 5G 5G 12% bro
worker-3-5 worker wrk3.xx.xx.xx 75130 child 429M 270M 0% bro
worker-3-6 worker wrk3.xx.xx.xx 75109 parent 5G 5G 18% bro
worker-3-6 worker wrk3.xx.xx.xx 75147 child 430M 271M 0% bro
worker-3-7 worker wrk3.xx.xx.xx 75097 parent 5G 5G 12% bro
worker-3-7 worker wrk3.xx.xx.xx 75149 child 429M 270M 0% bro
worker-3-8 worker wrk3.xx.xx.xx 75150 child 430M 269M 100% bro
worker-3-8 worker wrk3.xx.xx.xx 75106 parent 5G 5G 0% bro
worker-3-9 worker wrk3.xx.xx.xx 75105 parent 5G 5G 12% bro
worker-3-9 worker wrk3.xx.xx.xx 75146 child 429M 270M 0% bro
worker-4-1 worker wrk4.xx.xx.xx 63940 parent 5G 5G 18% bro
worker-4-1 worker wrk4.xx.xx.xx 63970 child 430M 270M 0% bro
worker-4-10 worker wrk4.xx.xx.xx 63937 parent 5G 5G 12% bro
worker-4-10 worker wrk4.xx.xx.xx 63974 child 431M 271M 0% bro
worker-4-11 worker wrk4.xx.xx.xx 63936 parent 5G 5G 75% bro
worker-4-11 worker wrk4.xx.xx.xx 63967 child 430M 270M 31% bro
worker-4-12 worker wrk4.xx.xx.xx 63927 parent 5G 5G 12% bro
worker-4-12 worker wrk4.xx.xx.xx 63966 child 430M 269M 0% bro
worker-4-13 worker wrk4.xx.xx.xx 63938 parent 5G 5G 25% bro
worker-4-13 worker wrk4.xx.xx.xx 63968 child 430M 270M 0% bro
worker-4-14 worker wrk4.xx.xx.xx 63939 parent 5G 5G 18% bro
worker-4-14 worker wrk4.xx.xx.xx 64008 child 430M 269M 6% bro
worker-4-15 worker wrk4.xx.xx.xx 63941 parent 5G 5G 12% bro
worker-4-15 worker wrk4.xx.xx.xx 63972 child 430M 270M 0% bro
worker-4-16 worker wrk4.xx.xx.xx 63931 parent 5G 5G 25% bro
worker-4-16 worker wrk4.xx.xx.xx 64003 child 430M 271M 0% bro
worker-4-17 worker wrk4.xx.xx.xx 63935 parent 5G 5G 25% bro
worker-4-17 worker wrk4.xx.xx.xx 64000 child 430M 270M 0% bro
worker-4-18 worker wrk4.xx.xx.xx 63928 parent 5G 5G 18% bro
worker-4-18 worker wrk4.xx.xx.xx 63995 child 430M 270M 0% bro
worker-4-19 worker wrk4.xx.xx.xx 63932 parent 5G 5G 18% bro
worker-4-19 worker wrk4.xx.xx.xx 63987 child 430M 271M 0% bro
worker-4-2 worker wrk4.xx.xx.xx 63933 parent 6G 5G 37% bro
worker-4-2 worker wrk4.xx.xx.xx 64009 child 430M 270M 0% bro
worker-4-20 worker wrk4.xx.xx.xx 63930 parent 5G 5G 37% bro
worker-4-20 worker wrk4.xx.xx.xx 63969 child 430M 271M 6% bro
worker-4-21 worker wrk4.xx.xx.xx 63929 parent 5G 5G 12% bro
worker-4-21 worker wrk4.xx.xx.xx 64005 child 430M 270M 0% bro
worker-4-22 worker wrk4.xx.xx.xx 63934 parent 5G 5G 31% bro
worker-4-22 worker wrk4.xx.xx.xx 63975 child 431M 271M 0% bro
worker-4-3 worker wrk4.xx.xx.xx 63945 parent 5G 5G 12% bro
worker-4-3 worker wrk4.xx.xx.xx 63973 child 430M 270M 0% bro
worker-4-4 worker wrk4.xx.xx.xx 63950 parent 5G 5G 43% bro
worker-4-4 worker wrk4.xx.xx.xx 64001 child 430M 270M 0% bro
worker-4-5 worker wrk4.xx.xx.xx 63949 parent 5G 5G 18% bro
worker-4-5 worker wrk4.xx.xx.xx 64002 child 430M 270M 0% bro
worker-4-6 worker wrk4.xx.xx.xx 63957 parent 5G 5G 6% bro
worker-4-6 worker wrk4.xx.xx.xx 64006 child 430M 270M 0% bro
worker-4-7 worker wrk4.xx.xx.xx 63964 parent 5G 5G 12% bro
worker-4-7 worker wrk4.xx.xx.xx 64007 child 430M 270M 0% bro
worker-4-8 worker wrk4.xx.xx.xx 63962 parent 5G 5G 56% bro
worker-4-8 worker wrk4.xx.xx.xx 63971 child 430M 271M 50% bro
worker-4-9 worker wrk4.xx.xx.xx 63965 parent 5G 5G 18% bro
worker-4-9 worker wrk4.xx.xx.xx 64004 child 430M 270M 0% bro
More information about the Bro
mailing list