[Snort-devel] Segfault, massive memory usage in 1.8.1beta3 build 47

Seth Leger soleger at ...511...
Fri Jul 20 15:59:47 EDT 2001


	Ok, after looking at it some more, it looks like the memory usage is all 
in the XML plugin when it is using file output mode. It seems like I 
looked at this code some time ago and it never flushes the memory for 
each alert XML tree after the file is written. Instead, it maintains a 
sort of memory copy of the entire XML log file.

	I might be able to work on a patch for this one of these days (if that's 
even really what's happening...) but until then I'm happy running TCP 
output mode for the plugin.

	Thanks for the tips. Those frag2 and stream4 plugins seem to be terribly 
efficient with memory; after I dropped the XML plugin, the memory usage 
hovered around 4 MB and dropped after heavy scans completed their runs. 
Looking good!

Seth Leger
soleger at ...511...





More information about the Snort-devel mailing list