Hi,
We have been having some problems with bro. We have been running bro for
a couple of days and we see that the memory usage of bro keeps
increasing monotonically. Bro eventually uses up all the memory on the
machine and crashes. Considering that we are running bro on a machine
with 2GB of memory, I guess this is not expected behavior.
A similar problem was reported way back in 1999, and Vern had then
proposed a fix.
http://mailman.icsi.berkeley.edu/pipermail/bro/1999-April/000813.html
http://mailman.icsi.berkeley.edu/pipermail/bro/1999-May/000818.html
But, we are using version 0.9a11 (the latest stable version available),
which already includes the above fix.
Has anyone else had similar memory problems? Is this a known problem?
Please let me know if you would like a snapshot of the data we are
receiving to diagnose the problem. Below is more information about the
system on which we are running bro and the increasing memory usage that
we notice.
Any help would much appreciated.
Thanks!
Harsha
System config:
Intel Xeon CPU 3.06GHz
2GB RAM
Linux 2.6.11-1.1369_FC4smp
Bro executed as:
sudo ./src/bro -i eth0 mt
Snapshot of bro's memory usage every 10 minutes since it is started:
top - 15:59:54 up 56 days, 1:45, 2 users, load average: 0.02, 0.02, 0.12
31919 root 15 0 35836 31m 2664 S 5.9 1.6 0:06.01 bro
top - 16:09:54 up 56 days, 1:55, 2 users, load average: 0.37, 0.19, 0.12
31919 root 15 0 77988 72m 2684 S 7.9 3.6 0:50.23 bro
top - 16:19:55 up 56 days, 2:05, 2 users, load average: 0.19, 0.20, 0.16
31919 root 15 0 86072 80m 2684 S 9.9 4.0 1:40.03 bro
top - 16:29:55 up 56 days, 2:15, 2 users, load average: 0.11, 0.12, 0.12
31919 root 15 0 90276 84m 2692 S 5.9 4.2 2:31.14 bro
top - 16:39:56 up 56 days, 2:25, 2 users, load average: 0.18, 0.16, 0.12
31919 root 15 0 105m 101m 2692 S 15.8 5.0 3:27.62 bro
top - 16:49:56 up 56 days, 2:35, 2 users, load average: 0.10, 0.12, 0.09
31919 root 15 0 105m 101m 2692 S 5.9 5.0 4:21.60 bro
top - 16:59:57 up 56 days, 2:45, 2 users, load average: 0.02, 0.08, 0.08
31919 root 15 0 105m 101m 2692 S 9.9 5.0 5:13.48 bro
top - 17:09:57 up 56 days, 2:55, 2 users, load average: 0.02, 0.08, 0.08
31919 root 15 0 105m 101m 2692 S 5.9 5.0 6:01.54 bro
top - 17:19:58 up 56 days, 3:05, 2 users, load average: 0.04, 0.08, 0.08
31919 root 15 0 105m 101m 2692 S 11.9 5.0 6:56.49 bro
top - 17:29:58 up 56 days, 3:15, 2 users, load average: 0.18, 0.17, 0.11
31919 root 15 0 111m 107m 2692 R 11.9 5.3 7:54.42 bro
top - 17:39:59 up 56 days, 3:25, 2 users, load average: 0.16, 0.12, 0.09
31919 root 15 0 111m 108m 2692 S 7.9 5.3 8:49.19 bro
top - 17:49:59 up 56 days, 3:35, 2 users, load average: 0.19, 0.21, 0.14
31919 root 15 0 120m 116m 2692 S 7.9 5.7 9:43.56 bro
top - 18:00:00 up 56 days, 3:45, 2 users, load average: 0.08, 0.10, 0.10
31919 root 15 0 120m 117m 2692 R 23.7 5.8 10:41.71 bro
top - 18:10:00 up 56 days, 3:55, 2 users, load average: 0.20, 0.12, 0.09
31919 root 15 0 120m 117m 2692 S 7.9 5.8 11:35.80 bro
top - 18:20:01 up 56 days, 4:05, 2 users, load average: 0.45, 0.26, 0.15
31919 root 16 0 123m 119m 2692 R 7.9 5.9 12:28.89 bro
top - 18:30:01 up 56 days, 4:15, 2 users, load average: 0.13, 0.14, 0.14
31919 root 15 0 131m 128m 2692 R 9.9 6.3 13:25.72 bro
top - 18:40:02 up 56 days, 4:25, 2 users, load average: 0.20, 0.16, 0.12
31919 root 15 0 138m 134m 2692 S 7.9 6.6 14:25.36 bro
top - 18:50:02 up 56 days, 4:35, 2 users, load average: 0.22, 0.15, 0.10
31919 root 15 0 142m 139m 2692 S 11.9 6.9 15:37.64 bro
top - 19:00:03 up 56 days, 4:45, 2 users, load average: 0.11, 0.15, 0.11
31919 root 15 0 142m 139m 2692 S 11.8 6.9 16:51.76 bro