Re: Snort gets killed

[Eric G <eric () nixwizard net>]

As Waldo said (and I kinda suspected this too), this is the Linux kernel
built in OOM killer.

Google 'Linux oom killer' if you'd like to know more, but honestly you're
going to need to throw more RAM at the VM to fix this one. It's basically
the kernel picking the snort process out and killing it because it's
consuming all the memory on the box

There's an ever so slight chance that it's a memory leak in snort that's
causing it to get killed as well

--
Eric
http://www.linkedin.com/in/ericgearhart
 On Jun 28, 2013 1:18 PM, "waldo kitty" <wkitty42 () windstream net> wrote:

> On 6/28/2013 11:03, Alex Adamos wrote:
> > these are the log files from both the Host and the guest VM. The guest
> VM has
> > 1536 MB RAM.
>
> from syslog, lines 365 and 366...
>
> Jun 27 16:04:27 alex-VirtualBox kernel: [ 6993.710126] Out of memory: Kill
> process 4503 (snort) score 773 or sacrifice child
> Jun 27 16:04:27 alex-VirtualBox kernel: [ 6993.710141] Killed process 4503
> (snort) total-vm:1862572kB, anon-rss:1338588kB, file-rss:12kB
>
> as i previously wrote, your virtual machine is out of memory and has
> killed off
> snort to be able to have enough memory for continued operations...
>
>
> --
> NOTE: No off-list assistance is given without prior approval.
>        Please keep mailing list traffic on the list unless
>        private contact is specifically requested and granted.
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Windows:
>
> Build for Windows Store.
>
> http://p.sf.net/sfu/windows-dev2dev
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:

Build for Windows Store.

http://p.sf.net/sfu/windows-dev2dev

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!