All,
Does anybody know how to make bro produce whatever debugging messages when
it crashes (maybe even a core file)? In my case it always crashes after
2-7 days of running but I have no way of figuring out how to figure out
what killed it.
I tried to do exec tracing, but it doesn't seem to do what I needed.
Best,
Did you keep an eye on Bro's memory usage? To my experience, if Bro
crashes regularly after running quite some time (hours to several
days, depending on the amount and nature of the traffic), it is most
of the time due to running out of memory. Loading reduce-memory.bro
helps a lot, but in our case I needed to tweak some additional
things as well (in particular setting timeouts on script-level
tables to expire old state). In an upcoming version, Bro will
probably give a more informational message if it runs out of memory.
Robin