[Bro] Worker System Memory Exhaustion

[Greg Grasmehr]

Hello List,

We're running Bro version 2.5-467 and shunting connections in an Arista
5100 via the excellent Dumbno.  The system is essentially a Bro-in-a-box
with 251G RAM and a Myricom SNF+ card.  Bro spawns 32 workers to monitor
a 10G link that averages roughly 5G and spikes to 7 on occasion.  Logs
are rotated every 1/2 hour.

The current configuration has been running for about 2 weeks and thus
far the only problem I have encountered is that given enough time, the
workers will eventually exhaust all of the available system memory
including scratch.

Currently I am running a watcher process which slowly restarts the
workers once available memory is < 4G and this has solved the problem,
but this seems an imperfect solution thus I am wondering if anyone knows
the source of the apparent memory leak?  Loaded scripts are attached and
thanks in advance for any informative illumination on this issue.

--
Sincerely,

Greg Grasmehr
California Institute of Technology (Caltech)
I ain't got a gat, but I have a soldering gun - W.A.Y.
GPGMe: 38E2 F9BD A95E 9824 20AB  331A 9E29 D1A1 AAEE 5F42
pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x9E29D1A1AAEE5F42

-------------- next part --------------
A non-text attachment was scrubbed...
Name: loaded_scripts.11:19:27-11:30:00.log.gz
Type: application/x-gzip
Size: 2863 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180405/c41254e6/attachment.gz