Snort mailing list archives
Re: Snort and memory
From: Martin Roesch <roesch () sourcefire com>
Date: Wed, 22 Aug 2001 10:20:33 -0400
Marcin Zurakowski wrote:
On Wed, 22 Aug 2001, Martin Roesch wrote:What output options are you using?I set something like this: # LOGING output alert_syslog: LOG_LOCAL6 And in my syslog.conf: local6.* /var/log/snort.log I've just discovered, that crond died...It has never happened before installation snort.
Well, Snort doesn't have any interaction with cron, but if your system is running out of memory that could be a problem. I don't know why Snort is using so much memory, we pretty much eliminated all the memory leaks in the standard loadout. Having just looked at the default vision18.conf file from whitehats.com, I see that the default preprocessor load is out of date, that's probably the problem. For the time being, I'd suggest using the snort.conf file that comes with Snort, and your logging setup. If you do that and still see excessive memory usage, let me know. -Marty -- Martin Roesch roesch () sourcefire com http://www.sourcefire.com - http://www.snort.org _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort and memory Marcin Zurakowski (Aug 22)
- Re: Snort and memory John Sage (Aug 22)
- Re: Snort and memory Martin Roesch (Aug 22)
- Re: Snort and memory Marcin Zurakowski (Aug 22)
- Re: Snort and memory Martin Roesch (Aug 22)
- Re: Snort and memory Scott Nursten (Aug 28)
- Re: Snort and memory Martin Roesch (Aug 28)
- Re: Snort and memory Marcin Zurakowski (Aug 22)
- Re: Snort and memory John Sage (Aug 22)
- <Possible follow-ups>
- RE: Snort and memory Mayers, Philip J (Aug 29)