Re: Memory Leak

["Jim Gifford" <maillist () jg555 com>]

----- Original Message ----- 
From: "Erek Adams" <erek () snort org>
To: "Jim Gifford" <maillist () jg555 com>
Cc: <Snort-users () lists sourceforge net>
Sent: Friday, July 11, 2003 11:31 AM
Subject: Re: [Snort-users] Memory Leak


> On Fri, 11 Jul 2003, Jim Gifford wrote:
>
> > I have been experience a memory leak on my system, I have tracked it
> > down to snort. Here is the problem the way I see it.
> >
> > snort starts out running on my system at 40mb.
> >
> > 3202 root       9   0 43580  40m 1152 S  0.0  4.0   0:05.66 snort
> >
> > After a day of running and a half of running snort goes up to 140+mb and
> > locks the system up.
> >
> > Any suggestions or patches.
> >
> > Snort was compiled from the source.
>
> hrm...  You may not actually have a leak.  I've got a copy of Snort that's
> been running since Jun 19, and it's at a constant 69MB.
>
> root     17319  0.0 26.5 69000 68936 C0  S+    19Jun03    2:51.49
> /usr/local/bin/snort
>
> 2.0 has a much larger memory footprint, especially if you are uing
> spp_conversation and spp_portscan2.  Have you tried just letting it run?
> It might get to some large amount and then stop.  You might also want to
> chech out the memory cap functions of spp_conversation.
>
> Cheers!
>
> -----
> Erek Adams
>
>    "When things get weird, the weird turn pro."   H.S. Thompson

Here is what I actually see after running a few hours
USER    PID     %CPU %MEM    VSZ            RSS        TTY    STAT START
TIME   COMMAND
root        4152   3.3      15.1           165456       156344   ?         S
13:28       1:34     snort -c /etc/snort/snort.conf -D -o





-------------------------------------------------------
This SF.Net email sponsored by: Parasoft
Error proof Web apps, automate testing & more.
Download & eval WebKing and get a free book.
www.parasoft.com/bulletproofapps1
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users