Use case : DNS traffic sent to logstash and then Easticsearch / kibana.
Packetbeat is installed as a service on a dedicated server.
I am using tcpreplay to send 1 gig of DNS trafic (for testing purpose )
When sending data, packetbeat uses about 70% of memory (2 Gigs of RAM on the VM) ...
Once the traffic hase been sent, memory consumption is not decreasing ....
And sometimes I can get packetbeat service killed by OS because too much memory used:
Please find a system log (/var/log/messages) extract
Dec 15 16:15:44 v-dns5 kernel: packetbeat invoked oom-killer: gfp_mask=0x200da, order=0, oom_adj=0, oom_score_adj=0
Dec 15 16:15:44 v-dns5 kernel: packetbeat cpuset=/ mems_allowed=0
Dec 15 16:15:44 v-dns5 kernel: Pid: 28466, comm: packetbeat Not tainted 2.6.32-358.6.2.el6.x86_64 #1
Dec 15 16:15:44 v-dns5 kernel: Out of memory: Kill process 28429 (packetbeat) score 768 or sacrifice child
Dec 15 16:15:44 v-dns5 kernel: Killed process 28429, UID 0, (packetbeat) total-vm:2898568kB, anon-rss:1500980kB, file-rss:4912kB
Dec 15 16:15:44 v-dns5 kernel: device eth1 left promiscuous mode
I am far for being an expert in those domains, so do not hesitate to ask me to provide more details by giving me the associated command lines (if needed).
Thanks alot for your help !