# Memory Issue with Bro **URL:** \ **Category:** Zeek\ **Created:** [September 28, 2015, 7:59pm UTC](https://community.zeek.org/t/memory-issue-with-bro/3850 "2015-09-28T19:59:24Z")\ **Posts on this page:** 10\ **Page:** 2
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [October 23, 2015, 2:19pm UTC](https://community.zeek.org/t/memory-issue-with-bro/3850/21 "2015-10-23T14:19:26Z")
Well that doesn't look great, but could be a lot worse. Hard to say without knowing what it looked like before the patch. The fact that pending ever goes down at all is a good sign, but pending=0 is really the optimal state. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 23, 2015, 3:09pm UTC](https://community.zeek.org/t/memory-issue-with-bro/3850/22 "2015-10-23T15:09:58Z")
Mike, could you back out that patch and try my branch, topic/seth/remove-flare ?   .Seth ---
**Author:** ![Aaron\_Lewis](https://avatars.discourse-cdn.com/v4/letter/a/e36b37/32.png) [@Aaron\_Lewis](https://community.zeek.org/u/Aaron_Lewis)\ **Post date:** [October 23, 2015, 3:29pm UTC](https://community.zeek.org/t/memory-issue-with-bro/3850/23 "2015-10-23T15:29:38Z")
Hey guys Fresh installation of bro 2.4.1, didn't modify scripts either I'm experiencing similar issues, now I wanted to know, can we limit the queue size (pending size)? 'Cause I don't care about packet losses I already checked the help messages in bro, there's simply no such option to configure, am I wrong? ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 23, 2015, 4:14pm UTC](https://community.zeek.org/t/memory-issue-with-bro/3850/24 "2015-10-23T16:14:12Z")
This isn’t an issue with packet queueing. It’s unfortunately quite a bit deeper than that and is related to Bro existing communication mechanism and a problem with it that we fairly recently became aware of. We’re still digging into the solution for the problem.   .Seth ---
**Author:** ![MICHAEL\_WAITE](https://avatars.discourse-cdn.com/v4/letter/m/7993a0/32.png) [@MICHAEL\_WAITE](https://community.zeek.org/u/MICHAEL_WAITE)\ **Post date:** [October 23, 2015, 4:38pm UTC](https://community.zeek.org/t/memory-issue-with-bro/3850/25 "2015-10-23T16:38:52Z")
After 30 min things look better, I will let you know how the rest of it makes out after a bit. Oct 23 12:09:52 manager child - - - info selects=100000 canwrites=97046 pending=0 Oct 23 12:11:54 manager child - - - info selects=200000 canwrites=97046 pending=0 Oct 23 12:14:04 manager child - - - info selects=300000 canwrites=97046 pending=0 Oct 23 12:14:43 manager child - - - info selects=400000 canwrites=97046 pending=0 Oct 23 12:15:20 manager child - - - info selects=500000 canwrites=97046 pending=0 Oct 23 12:15:54 manager child - - - info selects=600000 canwrites=97046 pending=0 Oct 23 12:16:38 manager child - - - info selects=700000 canwrites=97046 pending=0 Oct 23 12:17:41 manager child - - - info selects=800000 canwrites=97046 pending=0 Oct 23 12:19:03 manager child - - - info selects=900000 canwrites=97046 pending=0 Oct 23 12:20:46 manager child - - - info selects=1000000 canwrites=97046 pending=0 Oct 23 12:23:04 manager child - - - info selects=1100000 canwrites=97046 pending=0 Oct 23 12:25:10 manager child - - - info selects=1200000 canwrites=104987 pending=0 Oct 23 12:26:40 manager child - - - info selects=1300000 canwrites=104987 pending=0 Oct 23 12:28:13 manager child - - - info selects=1400000 canwrites=104987 pending=0 Oct 23 12:31:12 manager child - - - info selects=1600000 canwrites=110134 pending=0 Oct 23 12:32:24 manager child - - - info selects=1700000 canwrites=110134 pending=0 Oct 23 12:34:03 manager child - - - info selects=1800000 canwrites=110134 pending=0 Oct 23 12:35:12 manager child - - - info selects=1900000 canwrites=110134 pending=0 Oct 23 12:36:15 manager child - - - info selects=2000000 canwrites=110134 pending=0 Oct 23 12:37:31 manager child - - - info selects=2100000 canwrites=110134 pending=0 ---
**Author:** ![ericooi](https://avatars.discourse-cdn.com/v4/letter/e/ecae2f/32.png) [@ericooi](https://community.zeek.org/u/ericooi)\ **Post date:** [October 24, 2015, 2:39pm UTC](https://community.zeek.org/t/memory-issue-with-bro/3850/26 "2015-10-24T14:39:43Z")
I have two Security Onion sensors running 2.4, one monitors a combination of 100M general office internet traffic + 10G network, the other monitors four 1G networks which includes a publicly available website and lots of syslog and SMTP traffic. I ran the default Security Onion configuration on both and noticed the sensor monitoring four 1G networks would run out of memory over the course of a few hours. I spent a day turning off various analyzers until I isolated it to the intel analyzer. Ever since I turned intel.log off for that sensor, it’s run great for weeks. I tried adding intel feeds (via CriticalStack) and using a blank intel file, with no luck. Simply having the intel analyzer on always resulted in memory loss over time. I’m guessing it has something to do with the type of traffic that particular sensor sees (more HTTP, syslog, and SMTP), but I’m not entirely sure. Don’t know if it’s related, but just thought I’d share my experience with Bro memory issues. Eric ---
**Author:** ![Aaron\_Lewis](https://avatars.discourse-cdn.com/v4/letter/a/e36b37/32.png) [@Aaron\_Lewis](https://community.zeek.org/u/Aaron_Lewis)\ **Post date:** [October 24, 2015, 3:51pm UTC](https://community.zeek.org/t/memory-issue-with-bro/3850/27 "2015-10-24T15:51:40Z")
Hey Eric, How exactly did you turn off intel log? I tried to comment out this line, but nothing changed on my sensor, @load policy/frameworks/intel/seen Am I wrong? I was following this link: [https://www.bro.org/sphinx/frameworks/intel.html](https://www.bro.org/sphinx/frameworks/intel.html) ---
**Author:** ![ericooi](https://avatars.discourse-cdn.com/v4/letter/e/ecae2f/32.png) [@ericooi](https://community.zeek.org/u/ericooi)\ **Post date:** [October 24, 2015, 4:36pm UTC](https://community.zeek.org/t/memory-issue-with-bro/3850/28 "2015-10-24T16:36:01Z")
Hey Aaron, I did it by commenting out “@load intel” in /opt/bro/share/bro/site/local.bro. Give that a try and see if it works for you. Eric ---
**Author:** ![Aaron\_Lewis](https://avatars.discourse-cdn.com/v4/letter/a/e36b37/32.png) [@Aaron\_Lewis](https://community.zeek.org/u/Aaron_Lewis)\ **Post date:** [October 26, 2015, 5:21am UTC](https://community.zeek.org/t/memory-issue-with-bro/3850/29 "2015-10-26T05:21:03Z")
Thanks Eric, I tried that and it's not working for me ... I even commented out every protocol analyser. memory usage still goes up, just slower in time Perhaps the amount of traffic is too much for bro ids. I'm gonna send another email ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/memory-issue-with-bro/3850/30 "2022-05-06T15:43:07Z")
[Previous page](https://community.zeek.org/t/memory-issue-with-bro/3850.md?page=1)