# huge weird.log/conn.log **URL:** \ **Category:** Zeek\ **Created:** [December 1, 2016, 1:47pm UTC](https://community.zeek.org/t/huge-weird-log-conn-log/4524 "2016-12-01T13:47:02Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://community.zeek.org/u/erik_clark)\ **Post date:** [December 1, 2016, 1:47pm UTC](https://community.zeek.org/t/huge-weird-log-conn-log/4524/1 "2016-12-01T13:47:02Z")
I have two bro sensors. One is running 2.5, one is running 2.4.1. Both are running on the same link off the tap. The weird.log on the 2.5 box is 6 times bigger than the weird.log on the 2.4.1 log. Any idea why this might be? How can I troubleshoot this. My conn.log is 3 times bigger. For reference: conn.log → 2.5 (45 minutes) 17 gig conn.log → 2.4.1 (45 min) 5.5 gig weird.log → 2.5 (45 minutes) 11 gig weird.log → 2.4.1 (45 minutes) 1.2 gig These numbers seem to be WAY off. I have no idea how to even try and parse this to see what is going on. Packet loss on 2.4.1 is 6% Packet loss on 2.5 is 1%. ---
**Author:** ![Vlad\_Grigorescu3](https://avatars.discourse-cdn.com/v4/letter/v/dec6dc/32.png) [@Vlad\_Grigorescu3](https://community.zeek.org/u/Vlad_Grigorescu3)\ **Post date:** [December 1, 2016, 4:14pm UTC](https://community.zeek.org/t/huge-weird-log-conn-log/4524/2 "2016-12-01T16:14:25Z")
Can you take a look at what weirds, specifically, you're getting? Something like: > cat weird.log | bro-cut name| sort | uniq -c | sort -n   --Vlad erik clark \ writes: ---
**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://community.zeek.org/u/erik_clark)\ **Post date:** [December 1, 2016, 4:22pm UTC](https://community.zeek.org/t/huge-weird-log-conn-log/4524/3 "2016-12-01T16:22:09Z")
Hm. It looks like this may be related to af\_packet and bro2.5 in general. I did a subset of production weird and took a subset of development weird, sorted it out and compared the two. From the looks of things, the ratio of items in the files take in identical number of events is pretty close to identical. This leads me to believe that I am just not dropping traffic either at Bro or the interface on the dev box. Right now I have dropped only 70k packets out of 49TiB of traffic according to ifconfig, and bro is reporting packet loss of ~1%. The 2.4.1 production box on the other hand is seeing 2-5% packet loss and some packet loss at the interface. The services (http, dns, so on so forth) on the dev box all have equal or more than the number of events on the production box. All I can think of right now is that tuned af\_packet on rh7 w/ 2.5 is so much better than tuned pf\_ring on rh61 w/ 2.4.1 that it has been noticeable. Also, memory consumption on 2.5 is a significant fraction less than on the production box with the same link. Wish I could say why this is, but it really impresses me. Load is still high though at ~16, but MEH. ---
**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://community.zeek.org/u/erik_clark)\ **Post date:** [December 1, 2016, 5:24pm UTC](https://community.zeek.org/t/huge-weird-log-conn-log/4524/4 "2016-12-01T17:24:16Z")
Hmm. I note that I am actually, in a given hour, getting 25-30% less logs from http.log. Are there any guides to tuning Bro to work with af\_packet? ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [December 1, 2016, 5:48pm UTC](https://community.zeek.org/t/huge-weird-log-conn-log/4524/5 "2016-12-01T17:48:31Z")
Step 1: ensure that you can use af\_packet in the first place: [https://github.com/JustinAzoff/can-i-use-afpacket-fanout/](https://github.com/JustinAzoff/can-i-use-afpacket-fanout/) It looks like your current setup is not working. ---
**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://community.zeek.org/u/erik_clark)\ **Post date:** [December 1, 2016, 6:13pm UTC](https://community.zeek.org/t/huge-weird-log-conn-log/4524/6 "2016-12-01T18:13:14Z")
Sorry this was supposed to go to the list as well: Hmm. I see FAIL: saw flow {tcp $ip $num $ip $num} on workers $num and $num. This is on RHEL7 with the latest kernel. How can I address what I am assuming is a failure of the kernel? ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [December 1, 2016, 6:46pm UTC](https://community.zeek.org/t/huge-weird-log-conn-log/4524/7 "2016-12-01T18:46:46Z")
Yeah, that kernel does not work. I believe Michal said that if you upgrade the ixgb driver to the latest from intel and mess around with ethtool settings you can get it to work. ---
**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://community.zeek.org/u/erik_clark)\ **Post date:** [December 1, 2016, 8:25pm UTC](https://community.zeek.org/t/huge-weird-log-conn-log/4524/8 "2016-12-01T20:25:13Z")
Justin, any chance you might have that commentary stored anywhere? I spent the past 3 hours trying to find ethtool settings for this, but have had no success. The only thing I did find was –set-priv-flags $iface rss-symmetric off but I get no private flags found (for ixgbe nic). Other than that, I can find nothing anywhere concerning this issue that seems to be here. I did see: [https://media.readthedocs.org/pdf/jasonish-suricata/latest/jasonish-suricata.pdf](https://media.readthedocs.org/pdf/jasonish-suricata/latest/jasonish-suricata.pdf), specifically: ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/huge-weird-log-conn-log/4524/9 "2022-05-06T15:44:21Z")