I have been testing Bro 1.2.1 and the current 1.3.2. In both cases over time the memory is eventaully exhausted. It takes only a few hours with some intensive pcaps to reach this point. I spent a little bit of time running 1.3.2 through Valgrind but I was not able to find a definitive leak.
I will keep looking into this more but I wanted to see if anyone was aware if there are any potential memory leaks or are resources being used that are not being released?
Thanks,
// Joel
In general that can have a number of reasons. An internal memory
leak is one of them but not necessarily the most likely.
The best thing to do first is loading profile.bro. It will produce
an output file prof.log containing regular snapshots of the amount
of state stored inside various of Bro's components. Admittedly,
prof.log is a bit cryptic; feel free to send me a copy if you need
help interpreting it.
One very typical problem is that one of the script-level variables
gets large. If that is the case, the variable should show up in
prof.log in the sections starting with "Global_sizes > 100k". The
memory amounts given there are only very rough estimates but
generally the big hitters in terms of script-level state will show
up.
That said, a few leaks have been fixed since 1.3.2. Try the current
trunk to see if it changes anything; one or two more are fixed in my
development branch (see
http://www.bro-ids.org/wiki/index.php/Subversion#Public_Access for
how to get the code out of the Subversion repository).
Robin