Snort mailing list archives
Re: Snort 2.6.1 Stops Logging
From: Martin Roesch <roesch () sourcefire com>
Date: Tue, 21 Nov 2006 21:40:52 -0500
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 One thing you could do to help us figure out what's going on is to run gdb and attach it to the Snort process. Once it's attached, run a backtrace and if the program is stuck in function it should be very apparent. Can you try that and post the backtrace? -Marty On Nov 21, 2006, at 8:57 PM, Eric J. Feldhusen wrote:
Jason Haar wrote:Colin Grady wrote:I've migrated one system from Snort 2.6.0.2 <http://2.6.0.2> to Snort 2.6.1. I've made no configuration file changes and no command-line changes between the two releases, but after somewhere around 20-30 minutes after being started Snort 2.6.1 seems to stop logging data. I'm using unified logging, which is being processed through Barnyard. The Snort process continues to run and the processor time continues to climb, but the unified logs stop growing -- so it's not related to Barnyard as best as I can tell. Anyone else seen anything like this?I think this is a "me too". I've just noticed that 2.6.1RC1 appears to work initially, but stops logging at some later time. I am just upgrading to 2.6.1 to see if that fixes it - but your report implies it won't. We're using both syslog and mysql output modules - and both stop reporting - so that (plus your barnyard report) implies the problem is occurring somewhere earlier on. This is snort-2.6.1RC1 under CentOS4.4I've got a RHEL4u4 server with dual xeons with hyperthreading on, with snort-2.6.1 with mysql logging only and using Base 1.2.7 , and I've seen similar problems, the snortd process will run for about 20-120 minutes at a using 5-8% of the cpu, and then I'll check back later in the day and snortd process load is at 100%. I've been shutting of more and more included rule sets to see if it's a particular rule causing the problem. I'll have to try and see if I shut off all rules if it happens. Eric Feldhusen ---------------------------------------------------------------------- --- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php? page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
- -- Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616 Sourcefire - Security for the Real World - http://www.sourcefire.com Snort: Open Source IDP - http://www.snort.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin) iD8DBQFFY7i1qj0FAQQ3KOARAujwAJ4wuTuEqO/JCbMDG+ZwVNSufqRxrwCfd6ae Ya1ZXiiaV/lTfUke155kmWc= =t1lD -----END PGP SIGNATURE----- ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort 2.6.1 Stops Logging Colin Grady (Nov 21)
- Re: Snort 2.6.1 Stops Logging Jason Haar (Nov 21)
- Re: Snort 2.6.1 Stops Logging Eric J. Feldhusen (Nov 21)
- Re: Snort 2.6.1 Stops Logging Colin Grady (Nov 21)
- Re: Snort 2.6.1 Stops Logging Martin Roesch (Nov 21)
- Re: Snort 2.6.1 Stops Logging Jason Haar (Nov 22)
- Re: Snort 2.6.1 Stops Logging Eric Feldhusen (Nov 22)
- Message not available
- Re: Snort 2.6.1 Stops Logging Eric J. Feldhusen (Nov 22)
- Message not available
- Re: Snort 2.6.1 Stops Logging Eric J. Feldhusen (Nov 22)
- Re: Snort 2.6.1 Stops Logging Eric J. Feldhusen (Nov 21)
- Re: Snort 2.6.1 Stops Logging Jason Haar (Nov 21)