Having a low-footprint version of Bro hasn't been part of our operational
needs, so it hasn't received attention. I imagine the current footprint
could be diminished a fair amount by compiling out various functionality,
and doing so shouldn't be too hard in most cases since quite a bit of it
is modularized/layered pretty cleanly. (You can get a sense of where some
of the memory is going by using statistics.bro and print-globals.bro) This
won't be something for which we'll have cycles available to work on, though.
Vern