Re: snort keeps dying!!!

["M. Shirk" <shirkdog_list () hotmail com>]

The better questions:



Are you trying to run ALL SIGNATURES (including bleeding threats, and the Stormworm IP Signatures, about 15,000 
signatures)??



How much bandwidth is this firewall handling? (Mb/s)



Run Snort in non-daemon mode, and see the error you get when it stops running. 





Shirkdog

' or 1=1-- 



http://www.shirkdog.us
> Date: Thu, 6 Sep 2007 12:20:32 -0400
> From: joel.esler () sourcefire com
> To: titanyen2000 () yahoo com; snort-users () lists sourceforge net
> Subject: Re: [Snort-users] snort keeps dying!!!
>
> We'll probably need some kind of debug output to find out why it's dying
> since it's not printing any error messages.
>
> Are you running out of RAM on the box when Snort dies?
>
> J
>
>
> On 9/6/07 12:16 PM, "Zakai Kinan" <titanyen2000 () yahoo com> mentioned to me:
>
> > The firewall is using Debian Etch 4.1.  It is a Dell
> > PE 2950.  I have nothing in the logs.  Version 2.6.1.5
> > worked fine until I upgraded to latest version.
> >
> >
> > ZK
> >   
> > --- Joel Esler <joel.esler () sourcefire com> wrote:
> >
> > > What OS?  What hardware?  Do you have anything in
> > > your system log?
> > >
> > > Joel
> > >
> > >
> > > On 9/6/07 11:57 AM, "Zakai Kinan"
> > > <titanyen2000 () yahoo com> mentioned to me:
> > >
> > > > I just upgraded from 2.6.1.5 to 2.7.0.1 and now
> > > snort
> > > > keeps dying with no error messages.  I am using
> > > > snortsam, flex_resp2, and react.  I have lowered
> > > the
> > > > memory config to lowmem.  The firewall has two
> > > cpus
> > > > and 4GB of ram.  I start the daemaon and 2 minutes
> > > > later it stops suddenly.  Has anyone else
> > > encounter
> > > > this problem?
> > > >
> > > > TIA,
> > > >
> > > > ZK
> > > >
> > > >
> > > >        
> > ______________________________________________________________________________
> > > > ______
> > > > Need a vacation? Get great deals
> > > > to amazing places on Yahoo! Travel.
> > > > http://travel.yahoo.com/
> > -------------------------------------------------------------------------
> > > > This SF.net email is sponsored by: Splunk Inc.
> > > > Still grepping through log files to find problems?
> > >  Stop.
> > > > Now Search log events and configuration files
> > > using AJAX and a browser.
> > > > Download your FREE copy of Splunk now >>
> > > http://get.splunk.com/
> > > > _______________________________________________
> > > > Snort-users mailing list
> > > > Snort-users () lists sourceforge net
> > > > Go to this URL to change user options or
> > > unsubscribe:
> > > >
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > > >
> > >
> > > --
> > > joel esler | security consultant | Sourcefire | pgp
> > > is public
> >
> >
> >
> >       
> > ______________________________________________________________________________
> > ______
> > Shape Yahoo! in your own image.  Join our Network Research Panel today!
> > http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7
> >
> >
> >
> > -------------------------------------------------------------------------
> > This SF.net email is sponsored by: Splunk Inc.
> > Still grepping through log files to find problems?  Stop.
> > Now Search log events and configuration files using AJAX and a browser.
> > Download your FREE copy of Splunk now >>  http://get.splunk.com/
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> --
> joel esler | security consultant | Sourcefire | pgp is public
>
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >>  http://get.splunk.com/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

_________________________________________________________________
Connect to the next generation of MSN Messenger 
http://imagine-msn.com/messenger/launch80/default.aspx?locale=en-us&source=wlmailtagline

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users