On Tue, Oct 16, 2018 at 9:38 AM McMullan, Tim <[email protected]> wrote:
> We have been seeing occasional core dumps from bro, currently running on
> 2.5-870.
May be nice to try most recent master version to see if it still pops up.
> We’ve tried a few things to reproduce it on-demand but haven’t been
> successful. We were wondering if you might have some insight into the crash.
> This is the backtrace we get:
>
> #0 TableEntryVal::ExpireAccessTime (this=0x9b349bd32ebb5614) at
> /hostname/bro-devel-src/src/Val.h:741
>
> #1 TableVal::DoExpire (this=0x3955a40, t=1539447574.1403711) at
> /hostname/bro-devel-src/src/Val.cc:2353
I don't see an immediate culprit there -- it's the table entry
expiration algorithm that I guess is well-traveled by most people
running Bro, so maybe need to work on narrowing down a way to
reproduce or what specific script is triggering it. Do you have any
custom scripts that make use of &expire_func or &{read, write,
create}_expire table attributes? That could be a first place to
inspect. I also fixed a bug [1] in related code just last week, but
I'd expect that to give a different stack trace if it was the same
problem here (still doesn't hurt to try to rule that out as a
contributing factor by testing w/ latest git/master).
- Jon
[1] https://github.com/bro/bro/commit/8792f5545cd5b7de433d0eee510fde94371fdee3
_______________________________________________
bro-dev mailing list
[email protected]
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
