Re: daemon consuming 100% memory

[Matt Kettler <mkettler () evi-inc com>]

Well, lets see here. a quick rough guide:

1) if you aren't running snort 1.8.6 or better, download and install that. 
from the release notes:
                * Fixed stream4 several low memory conditions
2) if you have little memory in your system, either buy more ram, or shut 
down unnecessary garbage that a snort sensor doesn't need (ie: xwindows).
3) trim down your ruleset.

If that's not enough info, I agree with Chris:
>how much memory do you have, what snort version, what configuration options?

Without that information it's impossible to make any kind of reasonable 
estimate of where your problem lies, only broad generalizations.



At 02:24 PM 5/13/2002 +0800, kukulkan wrote:
> Hi all,
>       I am running latest snort, running almost every snort rules, using
> redhat 7.2. My problem is after about 5-6 hours, my snort daemon will
> using 100% memory before it dies. Is this the flaw inside the
> program?How can I prevent the daemon from dying after 5-6 hours?
>
> kukulkan
>
>
> _______________________________________________________________
>
> Have big pipes? SourceForge.net is looking for download mirrors. We supply
> the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users