Re: Snort 1.9.0 Hard Crashes/Lockups

[Demetri Mouratis <dmourati () cm math uiuc edu>]

On Thu, 6 Feb 2003, Ricardo, Gerson wrote:

> Most every time i start snort on my linux (RH 7.3) server it locks up at
> wholly sporadic times.

<snippage>

> System setup:
> **********************
> Dell 2650 Dual 2.4Ghz HT Xeons/512k L2 (Dell calls HT 'logical processor')
> 1GB DDR 1600 Dual Channel Memory (200Mhz)
> Broadcom Serverworks Chipset (Supporting PCI-X)
> PERC3/Di RAID Controller w/ 128MB Cache (really an imbedded relabeled AMI/LSI raid controller)
> Dual onboard GigE Broadcom ethernet ports (eth0 and eth1 - snort sensor on eth1)
> Dual 3com 64bit 1000SX PCI Nics (PCI 2.1/64bit/66Mhz) - interfaces currently disabled

<very juicy details snipped>

I would start by looking at your NICs.  Since you have the 3com 1000SXs
not being used, see if you can move your sensor to that interface.

Question:  How are  your NICs supported in your kernel?  Compiled in?
Modules?

You may want to download pristine kernel source and rebuild a custom
kernel for this box with support for (both) NICs.

Rebuild snort from source.

Look more carefully through your logs to see what is happening right
before your system locks up.

Good luck.
---------------------------------------------------------------------
Demetri Mouratis
dmourati () linfactory com



-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users