Re: Snort dumps core on Solaris 8

[Tom Kyle <tom () eos umsl edu>]

Hrm.  I just grabbed the latest snort beta tarball, and it's coring as
well.  But at least it does it within a few minutes.

Upon startup, I get hundreds of "freeing AVL node" messages and then
after about a minute or so snort complains that "max nodes reach, data
is not inserted" after which it segfaults and dumps core.

Whee.

Tom

Tom Kyle wrote:
> In my snort.conf, I have defrag, http_decode, portscan, and
> portscan-ignorehosts enabled as preprocessors.  No output plugins are
> enabled.
>
> Running it in the foreground (no -D), it complains of a Bus Error.
> Checking other projects' lists, I noticed some complaints about the
> optimization routines in gcc 2.95.x on Solaris producing similar
> problems, so I compiled snort with -O0 (no optimization), rather than
> the default -O2.  It's been running for over two hours now without
> coring, so I think that this might have done the trick.
>
> Thanks for the input,
>
> Tom
>
> Thomas Whipp wrote:
> > I've been running Snort for about 2 weeks with no
> > instability on an Ultra 5 with Solaris 8, I've also tested
> > it on Solaris 8 on a Netra T1 and Netra X1 without
> > problems... what pre-processors/logging options do you have
> > enabled?
> >
> >         Tom
> >
> > > -----Original Message-----
> > > From: Tom Kyle [mailto:tom () eos umsl edu]
> > > Sent: 04 June 2001 19:32
> > > To: snort-users () lists sourceforge net
> > > Subject: [Snort-users] Snort dumps core on Solaris 8
> > >
> > >
> > > I've been trying to use snort 1.7 that I compiled from
> > source with gcc
> > > 2.95.3 on an Ultra 5 running Solaris 8.  Unfortunately, it
> > dumps core
> > > after running for some time (usually 30-120 minutes).
> > > I'm using 'snort -Afull -c snort.conf -l /snort -d -D' to
> > > invoke snort.
> > > Is anyone aware of any issues with snort & Solaris 8, and
> > if
> > > so, of any
> > > workarounds?
> > >
> > > Thanks!
> > >
> > > Tom
> > >
> > > --
> > >
> > > Thomas A. Kyle
> > > Network Security Administrator
> > > University of Missouri-St. Louis
> > > tkyle () jinx umsl edu
> > > (314) 516-6012
> > >
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users () lists sourceforge net
> > > Go to this URL to change user options or unsubscribe:
> > > http://lists.sourceforge.net/lists/listinfo/snort-users
> > > Snort-users list archive:
> > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > http://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> --
>
> Thomas A. Kyle
> Network Security Administrator
> University of Missouri-St. Louis
> tkyle () jinx umsl edu
> (314) 516-6012
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 

Thomas A. Kyle
Network Security Administrator
University of Missouri-St. Louis
tkyle () jinx umsl edu
(314) 516-6012

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users