Re: SNORT has memory leak on Linux Red hat 9

[ypwhich <ypwhich () paunix org>]

Chances are Linux and SNORT are behaving.  You may be reading the output
of "free -t" or "procinfo" incorrectly....which is easy to do, especially
if coming to Linux from a Win32s environment.  The two systems manage
memory differently.

Unless you're noticing a major performance hit after killing SNORT,
chances are you're fine.  If you like copy the output of "free -t" to
email after killing SNORT, will have a look at it.

-yp



On Wed, 25 Feb 2004, Kumar, Manoj wrote:

> Date: Wed, 25 Feb 2004 17:14:31 -0500
> From: "Kumar, Manoj" <kumarm () netscout com>
> To: Jeremy Hewlett <jh () sourcefire com>, snort-users () lists sourceforge net
> Cc: snort-devel () lists sourceforge net, snort-announce () lists sourceforge net
> Subject: [Snort-users] SNORT has memory leak on Linux Red hat 9
>
> Hello everybody,
> I am running SNORT ver 2.1.0 to capture data from my giga bit network on RedHat Linux 9 where SNORT is capturing 
> 100MB of data per minute (Lots of data). Problem is that memory usage keeps going as long as SNORT is running.
> WORST thing is that even if you kill the SNORT process, it doesn't release the memory. Memory usage remains as it is.
> Would you guys please help me out? Why SNORT is behaving like this and anybody has noticed this problem?
>
> Thanks
> Manoj
>
>
> -----Original Message-----
> From: Jeremy Hewlett [ mailto:jh () sourcefire com]
> Sent: Wednesday, February 25, 2004 4:41 PM
> To: snort-users () lists sourceforge net
> Cc: snort-devel () lists sourceforge net;
> snort-announce () lists sourceforge net
> Subject: [Snort-devel] Snort 2.1.1 final is available!
>
>
> Greetings!
>
> Snort 2.1.1 is now available - Thanks everyone who installed RC1 and
> tried it out! The differences between RC1 and final are minor, and
> include:
>
> * Documentation updates and fixes by JP Vossen, Felipe Franciosi, and
>   Drew Smith
> * Compiles on Tru64 now - thanks Hari Gopal and Darryl Cook.
> * libintsnort.a is no longer included in compile routine (this is the
>   Solaris "ar" problem some people have had)
> * Snort templates have been updated
> * Fixed issue with CSV not displaying its output correctly - thanks
>   Bill Guyton and Alan Milligan for your fixes.
> * Fixed Flow-Portscan alert-mode bug where only one alert would get
>   generated.  Thanks Kevin Amorin for pointing out the problem and
>   testing the fix.
> * Minor Makefile fix for "unexpected end of line" at the verstuff.pl
>   line when not using GNU "make" on Solaris - Thanks for the report,
>   Chad Kreimendahl.
> * Removed escaping of '%' and '_' characters in MySQL (thanks
>   Kristofer Karas).
>
> For further info on changes, please review the ChangeLog and
> RELEASE.NOTES, which can be found in the parent directory of the snort
> source.
>
> Happy Snorting,
> The Snort Team
>
>
>
> -------------------------------------------------------
> SF.Net is sponsored by: Speed Start Your Linux Apps Now.
> Build and deploy apps & Web services for Linux with
> a free DVD software kit from IBM. Click Now!
> http://ads.osdn.com/?ad_id=1356 <http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click> &alloc_id=3438&op=click
> _______________________________________________
> Snort-devel mailing list
> Snort-devel () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-devel

ypwhich () paunix org
SDF Public Access UNIX System - http://sdf.lonestar.org


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users