Arne Welzel

I had looked at analyzer_confirmation/violation a bit more. * Found #2437 while there. This will conflict with this branch so can also fold it in here if you'd prefer, but...

Hey @pbcullen - thanks. Which Zeek version has this been observed with? Is this something new with 5.0, or has been around with Zeek 4.0/4.2 already just never reported? Tangentially,...

Attaching a 1mio-entries intel file with IP addresses for testing. Unzipped it's 60mb: [1mio-ip-addresses.intel.zip](https://github.com/zeek/zeek/files/9489743/1mio-ip-addresses.intel.zip) Without any proxies or workers started, loading this file alone brings the manager from 100MB to...

Better stacks (building Zeek with -fno-omit-frame-pointers, ) from the manager while running at 200%:  So this appears to indicate that: * the manager main thread spends a lot of...

> What objects are involved here? Can we get a jemalloc profile at that point? Is there some way we can shrink those objects (repacking, etc)? I'm tempted to say...

> Arne says the large data file sends the manager to 7.5GB, and it seems that's hard to improve significantly. > But when running with 32 workers, the manager usage...

I've tested a bit in @pbcullen 's environment: * 30 workers pinned to individual CPUs, Intel(R) Xeon(R) Gold 6152 CPU @ 2.10GHz, manager running on separate CPUs * Manager running...

Hmm, incrementing the size by 1 mio instead of times 10, it already triggers a crash for 5mio (but didn't for 8mio or 16mio): Note, also the 3000000 timing: It...

One more data point, incrementing by 100 000 starting from 1mio triggers the error at 2.3 mio entries (not shown). And again more surprising timing variations. ``` $ time zeek...

@jasonlue , @timwoj - I suspect this was fixed as a side-effect of the #2387 fix?