file is too large

Zeek
1

Hi all,

I am trying to run Bro offline on files bigger than 2 GB. It does nothing, except saying "File is too large". Has anyone encountered the same problem? Is there any way of getting Bro to read files bigger than 2 GB? Thanks in advance.

regards

2

Hi,

what platform is this on, and what release? 1.1 does configure large
file support. Look for the following output in your configure run:

checking for _FILE_OFFSET_BITS value needed for large files... 64
checking for _LARGE_FILES value needed for large files... no

If it does not work despite the presence of those, we may not be using
large-file enabled operations in all places.

3

Hi,

what platform is this on, and what release? 1.1 does configure large
file support. Look for the following output in your configure run:

checking for _FILE_OFFSET_BITS value needed for large files... 64
checking for _LARGE_FILES value needed for large files... no

If it does not work despite the presence of those, we may not be using
large-file enabled operations in all places.

ps: note that if this message comes up from pcap then it might be the
case that your pcap library cannot handle large files. See e.g.

http://mailman.icsi.berkeley.edu/pipermail/bro/2006-March/002343.html

4

This issue has been resolved by an upgrade to Bro 1.1.