search

brimdata / zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
https://www.zeek.org
Other
2 stars 0 forks source link

Apparent memory leak in Windows port of Zeek #40

Closed philrz closed 8 months ago

philrz commented 4 years ago

In a Slack conversation a community user reported a possible memory leak when observing Brim's Zeek process running on Windows. I attempted to reproduce this and it does seem likely. Importing the 4 GB all.pcap we often test with into Brim v0.17.0 (so, using the Zeek artifact v3.2.0-dev-brim9) and watching in Task Manager, the reported memory use started around 80 MB and gradually climbed throughout the import to a peak of about 570 MB as it finished. Repeating the same on macOS, the Activity Monitor reported that Zeek's memory use ramped to 108.5 MB by the middle of the import process, and the usage remained flat throughout the remainder of import. While I know that Zeek maintains some state during its runs and I'm not surprised to see some ramp, clearly the slope on the Windows side is suspiciously high.

philrz commented 2 years ago

I've confirmed this issue is still present as of GA Brim tagged v0.31.0.

philrz commented 10 months ago

Now that Windows support for Zeek is more official and we're doing builds from current code in https://github.com/brimdata/build-zeek, I had high hopes that this problem would have gone away. Unfortunately it seems I can still reproduce it. I've opened an issue at https://github.com/zeek/zeek/issues/3590.

philrz commented 8 months ago

As noted in the last comment, this memory leak is now being tracked in its proper home at https://github.com/zeek/zeek/issues/3590. It probably doesn't make sense for us to hold redundant open issues for every problem we've found that ultimately needs to be fixed in another pcap analyzer. Per https://github.com/brimdata/brimcap/issues/337, I plan to consolidate info about such issues in one location (probably the Brimcap wiki) and link to relevant issues from there.

In the meantime, I'm going to close this redundant issue.