Installing

zkg install zeek-jemalloc-profiling

Verify jemalloc support:

root@x230:~# zeekctl jeprof.check
jemalloc profiling enabled: True

Enabling

In your node.cfg add jeprof_enable=1 like so:

[worker-1]
type=worker
host=localhost
interface=af_packet::eth0
lb_method=custom
lb_procs=2
jeprof_enable=1

All options

Node options:

jeprof_enable=1  # Enable jeprof
jeprof_all_workers=true #Enable profiling on all workers instead of just the first one

Global options for broctl.cfg:

jeprof.malloc_conf=...  # extra options to add to MALLOC_CONF
jeprof.lg_prof_interval=30 # see http://jemalloc.net/jemalloc.3.html#opt.lg_prof_interval

Processing profile output

./process.py /usr/local/zeek/spool | tee -a jeprof.log

Graphing

The `process.py` script can be useful to stream the profile to an external metrics system for long term recording.

For interactive debugging it can be more useful to use the `jeprof utility directly with the .heap` files stored in a worker's spool directory.

Either by using the text interface directly, or export data to an SVG file (or the dot raw data with `--dot`):

$ jeprof /opt/zeek/bin/zeek --svg $(ls /opt/zeek/spool/worker-1-1/jeprof.out*heap | tail -n 1) > profile-$(date +%Y%m%d-%H%M%S).svg

Above command will produce an SVG for the most recent .heap file created.