Re: snort 1.9.0 memleaking ?

[Erek Adams <erek () theadamsfamily net>]

On Wed, 27 Nov 2002 pilsl () goldfisch at wrote:

> I'm just a beginner with snort and installed it about one month ago on
> a recent linux-system with postgresql-support and query the whole
> stuff using acid.
>
> Today I had to find that one of my two snort-processes on the gateway
> takes up to 60MB (not shared) which is quite a lot even for a
> 520-machine.
>
> Anyone seen something similar. By now I restarted the daemons and will
> watch them more closely.

It's not a memleak.

It's stream4, conversation and portscan2.  They track connections and need
a lot of memory to keep all the info in.  You can change the memory usage
by setting the 'memcap' options in snort.conf for the preprocessor(s) in
question.  You can also drop the number of conversations that are stored
by using 'max_conversations'

Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net




-------------------------------------------------------
This SF.net email is sponsored by: Get the new Palm Tungsten T 
handheld. Power & Color in a compact size! 
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users