I moved to BRO 2.0 few days ago, so far it works great.
I am testing the SMTP write file to disk feature (entities.bro) which also works great on file attachments.
Due to load on my machine (60mbps) there are packet drops which causes the file assembly to be corrupted (BRO is running on tap and not in-line).
I suspect that the drops are caused by the excessive I/O when writing these attachments to disk.
I decided to optimize bro to get rid of the drops:
- I disabled all the scripts in init-default.bro (beside smtp) and also logging capabilities.
- Increased the system allocated buffer size in setvbuf() (BroFile::SetBuf - File.cc)
- Writing the file into tmpfs instead of the local directory
I am still suffering drops.
Am i doing something wrong? is there anyway to optimize it even better to get rid of the drops?