I came across BIT-1103 regarding a memory leak affecting Bro 2.2 in JIRA which appears to have been resolved recently. Any chance that ticket and fix has relevance to the discussion from last week concerning gradual memory exhaustion in Bro 2.2?
Regards,
Gary
Hi,
the fix in BIT-1103 only applies to you if you are extensively using the input
framework to read events — e.g. by using the intelligence framework and updating
it regularly.
If you do not use the Input framework to import data into Bro, this fix will
change nothing. It also should not change memory on any worker nodes (the
input framework usually is only used on the master).
Johanna