Memory leak?

Hey guys,

I’m trying to figure out if there is a memory leak in Bro that’s causing me issues. I wonder if it’s a memory leak because every few hours i’ll have a worker die like this:

If you want to help us debug this problem, then please forward this mail to

Bro 2.3.1

Linux 2.6.32-358.11.1.el6.x86_64

==== No reporter.log

==== stderr.log

listening on bond1, capture length 8192 bytes

1411357505.663118 processing suspended

1411357505.663118 processing continued

1411392324.017784 received termination signal

1411392324.017784 105126164 packets received on interface bond1, 0 dropped

==== stdout.log

max memory size (kbytes, -m) unlimited

data seg size (kbytes, -d) unlimited

virtual memory (kbytes, -v) unlimited

core file size (blocks, -c) unlimited

==== .cmdline

-i bond1 -U .status -p broctl -p broctl-live -p local -p worker-0-3 local.bro broctl base/frameworks/cluster local-worker.bro broctl/auto

==== .env_vars




==== .status


==== No prof.log

==== No packet_filter.log

==== No loaded_scripts.log


At a glance… with only the information available… It looks more like Bro is legitimately filling up the system memory and the kernel is OOM killing your Bro worker. How much memory is in this worker, what kind of connection is it monitoring? Are you willing to provide a copy of your reporter.log?


Fantastic advise. The reporter.log showed a bug for an empty variable inside a when statement. Fixed it with an if - check and i’m not seeing any errors. Hopefully this will quell the memory issues. Thanks for the help.




No problem at all!

Errors in script land DO cause memory leaks :slight_smile: