bro manager stops writing logs - EINTR issue ?

Development
1

Hello,
I would appreciate anyone’s help on the following issue :

setup: 24 workers,1 proxy, 1 manager. each worker has a bloomfilter of its own so eventually very few events are passed on to the manager for writing. there is only 1 log file being written (dns.log) which fills at a rate of about 10k lines per sec.

problem: after a few hours, manager stops writing the log file though everything is still running. no errors on debug.log or stderr.log.
I ran strace and found that the manager’s child process has EINTR issue:

ERESTARTNOHAND to be restarted if no handler
SIGALRM {si_signo=SIGALRM, si_code=SI_KERNEL}
rt_sigreturn()=-1 EINTR (interrupted system call)

I read that bro should handle EINTR errors internally.

any suggestions on what can be done ?

thanks !
Barak

2

I'm not completely sure what's causing the issue that you're seeing, but could you try running your same workload with a branch I've worked on some?
  topic/seth/remove-flare

Thanks!
  .Seth

3

hi

can you please post the full url for your version ?
i cant find it under https://github.com/sethhall

thanks

4

It's a branch on the main Bro repository.

  .Seth