Hey All, Running Bro 2.5 on a single server with 20 cores and some 240 GB of memory. node.cfg specifies 14 workers, 2 proxies, 1 manager and a 1 logger process. We are running a custom build of bro built with tmalloc enabled and pfring enabled. I’m working to get my bro cluster stable. As it sta…

Most likely this isn't a leak, but that the logger process isn't able to process the data fast enough. What model CPUs does this server have? Can you show what this command outputs after bro has been running for a bit: top -b -n 1 -H -o TIME | fgrep bro: | head -n 20 The last column will be …

Hey Justin, The results of running top (the "-o TIME" parameter set was unavailable on my system) # top -b -n 1 -H | fgrep bro: | head -n 20 48059 root 20 0 4496m 4.0g 260m S 27.7 1.7 38:36.49 bro: conn/Log:: 47908 root 20 0 4496m 4.0g 260m S 5.5 1.7 8:29.99 bro: weird/Log: …

Hey Justin, The results of running top (the "-o TIME" parameter set was unavailable on my system) Ah, it looks like the default is close enough. # top -b -n 1 -H | fgrep bro: | head -n 20 48059 root 20 0 4496m 4.0g 260m S 27.7 1.7 38:36.49 bro: conn/Log:: 47908 root 20 0 4496…

Thank you for the response Justin! I will continue investigating whether or not pfring is misconfigured. Last week I did fiddle with CPU pinning with no change to the logger crashing behavior. The current configuration is: Manager: pinned to 0 Logger: pinned to 1 Workers: pinned to 2-15 Proxie…

Logger Child Memory Leak (logger crashing often)

Zeek

Topic		Replies	Views
Memory Issue with Bro Zeek	29	239	May 6, 2022
Bro cluster requirements and manager logging backlog bug Zeek	34	215	May 6, 2022
Why does my logger keep crashing - bro version 2.6.3 Zeek	8	295	May 6, 2022
Bro's limitations with high worker count and memory exhaustion Zeek	18	161	May 6, 2022
BRO Logger crashing due to large DNS log files Zeek	22	226	May 6, 2022

Logger Child Memory Leak (logger crashing often)

Related topics