[Bro] logger large memory usage

Bortoli, Tomas tomas.bortoli at sit.fraunhofer.de
Tue May 9 01:36:25 PDT 2017


I might be wrong but using Redis you can't store more than your actual RAM capacity
Check out: https://redis.io/topics/faq

Hope this helps,
Tomas

________________________________
From: bro-bounces at bro.org [bro-bounces at bro.org] on behalf of Bowen Li [newfire.bw at gmail.com]
Sent: Monday, May 08, 2017 4:16 PM
To: bro at bro.org
Subject: [Bro] logger large memory usage

Hey all,

I`m running a bro cluster in 10G network, writing logs to redis server directly use plugins,  when the cluster is running, the memory usage of the logger has been growing larger and larger(hundreds of Gb), seems like the logger cannot handle the huge number of the log messages, so the question is what`s the processing capacity of the logger? In my case, 25000 msgs/sec to redis. And why not use more loggers in one cluster but only one?

Any insight would be helpful.

Bowen Li
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170509/e09a0c8f/attachment.html 


More information about the Bro mailing list