[Zeek] tcmalloc large alloc

[Seth Hall]

On 25 Mar 2019, at 15:33, Rogers, Zach wrote:

> We have been seeing some crash reports on some of our nodes, regarding 
> a tcmalloc error. I was wondering if anyone else has seen this before 
> and if anyone has any suggestions on what the cause might be. We are 
> running Zeek 2.6. Here is an example stderr.log output from one of 
> these crashes:

We've seen evidence before that there is a file analyzer freaking out 
with particular files and attempting to do these very large allocations. 
  Unfortuantely we still don't have concrete indications about exactly 
what is causing the problem.  It would be helpful for us if you 
converted those offsets into symbolic procedure names.  You can do it 
this way (just specify the correct location for your binary)...

addr2line -e /usr/local/bro/bin/bro 0x7f72a12604ef 0x7f72a1280d56 
0x9623cf 0x9623ff 0x8d8c90 0x8d1b79 0x928352 0x92895f 0x928a71 0x9242bd 
0x7b5908 0x7ff59f 0x7b535d 0x7b555f 0x7b3a98 0x8c422e 0x8c3a70 0x95d49e 
0x95dc16 0x8c33cc 0x8c36f9 0x8c323f 0x8c18be 0x8bef32 0x95d352 0x5c61dd 
0x676f75 0x677f1c 0x648a0f 0x914669 0x648ec5

   .Seth

--
Seth Hall * Corelight, Inc * www.corelight.com