Re: Snort 2.6.1 Stops Logging

[Jason Haar <Jason.Haar () trimble co nz>]

Martin Roesch wrote:
> One thing you could do to help us figure out what's going on is to  
> run gdb and attach it to the Snort process.  Once it's attached, run  
> a backtrace and if the program is stuck in function it should be very  
> apparent.
>
> Can you try that and post the backtrace?
>
>  
Sure can. My newly upgraded 2.6.1 system still shows the same symptoms -
and they kicked in after <1 hour of starting.

I have three snort-mysql's processes running on this particular box -
two are in the "S" (sleep) state and the broken one is stuck in "R"
(running). Attaching to that process with strace shows ZERO activity -
normally you'd expect to see lines of text per packet. So it's
definitely unhappy.

gdb --pid=PID followed by a BT attached.

PS: this is on a CentOS4.4 system, with kernel 2.6.18 (non-smp)

Jason


------------------


[root~]# gdb --pid=7965
GNU gdb Red Hat Linux (6.3.0.0-1.132.EL4rh)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu".
Attaching to process 7965

warning: The current VSYSCALL page code requires an existing execuitable. 
Use "add-symbol-file-from-memory" to load the VSYSCALL page by hand
Reading symbols from /usr/sbin/snort-mysql...(no debugging symbols found)...done.
Using host libthread_db library "/lib/tls/libthread_db.so.1".
Reading symbols from /usr/lib/mysql/libmysqlclient.so.15...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/mysql/libmysqlclient.so.15
Reading symbols from /usr/lib/libz.so.1...
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libz.so.1
Reading symbols from /lib/libpcre.so.0...(no debugging symbols found)...done.
Loaded symbols for /lib/libpcre.so.0
Reading symbols from /usr/lib/libpcap.so.0.8.3...
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libpcap.so.0.8.3
Reading symbols from /lib/tls/libm.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/tls/libm.so.6
Reading symbols from /lib/libnsl.so.1...
(no debugging symbols found)...done.
Loaded symbols for /lib/libnsl.so.1
Reading symbols from /lib/libdl.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/tls/libc.so.6...
(no debugging symbols found)...done.
Loaded symbols for /lib/tls/libc.so.6
Reading symbols from /lib/libcrypt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libssl.so.4...
(no debugging symbols found)...done.
Loaded symbols for /lib/libssl.so.4
Reading symbols from /lib/libcrypto.so.4...(no debugging symbols found)...done.
Loaded symbols for /lib/libcrypto.so.4
Reading symbols from /lib/ld-linux.so.2...
(no debugging symbols found)...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /usr/lib/libgssapi_krb5.so.2...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libgssapi_krb5.so.2
Reading symbols from /usr/lib/libkrb5.so.3...
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libkrb5.so.3
Reading symbols from /lib/libcom_err.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libcom_err.so.2
Reading symbols from /usr/lib/libk5crypto.so.3...
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libk5crypto.so.3
Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libresolv.so.2
Reading symbols from /lib/libnss_files.so.2...
(no debugging symbols found)...done.
Loaded symbols for /lib/libnss_files.so.2
Reading symbols from /usr/lib/snort-2.6.1_dynamicengine/libsf_engine.so...done.
Loaded symbols for /usr/lib/snort-2.6.1_dynamicengine/libsf_engine.so
Reading symbols from /usr/lib/snort-2.6.1_dynamicpreprocessor/libsf_dns_preproc.so...done.
Loaded symbols for /usr/lib/snort-2.6.1_dynamicpreprocessor//libsf_dns_preproc.so
Reading symbols from /usr/lib/snort-2.6.1_dynamicpreprocessor/libsf_ftptelnet_preproc.so...done.
Loaded symbols for /usr/lib/snort-2.6.1_dynamicpreprocessor//libsf_ftptelnet_preproc.so
Reading symbols from /usr/lib/snort-2.6.1_dynamicpreprocessor/libsf_smtp_preproc.so...done.
Loaded symbols for /usr/lib/snort-2.6.1_dynamicpreprocessor//libsf_smtp_preproc.so
0x0807bea1 in BuildPacket ()
(gdb) bt
#0  0x0807bea1 in BuildPacket ()
#1  0x0807c711 in FlushStream ()
#2  0x0807d84c in ReassembleStream4 ()
#3  0x0805f111 in Preprocess ()
#4  0x080584e9 in ProcessPacket ()
#5  0x0805b99c in PcapProcessPacket ()
#6  0x4bda14ae in ?? () from /usr/lib/libpcap.so.0.8.3
#7  0x00000000 in ?? ()
(gdb) quit
The program is running.  Quit anyway (and detach it)? (y or n) y
Detaching from program: /usr/sbin/snort-mysql, process 7965

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users