[Snort-devel] Error on 1.8.7beta2 (Build 114) (Immediate exit after initialization)

James Hoagland hoagland at ...60...
Sat May 11 12:39:01 EDT 2002


At 12:30 PM -0500 5/11/02, Rob Hughes wrote:
>All,
>
>Built from CVS this morning. Now I get this error within 1-2 seconds of
>starting snort:

[snip]

>exhausted all 0 blocks of 1 treeroots; exiting; you might want to
>increase DEFAULT_MAX_ROOT_BLOCKS or DEFAULT_ROOT_BLOCK_SIZE in params.h
>next free root: 0; int: 0, leaf: 0


Viola!  Figured out the problem.  The message is from Spade.  We had 
someone else have this puzzling problem but never figured it out.

>preprocessor spade-adapt2: 0.01 15 4 24 7
>preprocessor spade-threshlearn: 200 24
>preprocessor spade-survey:  $SPADEDIR/survey.txt 60
>preprocessor spade-stats: entropy uncondprob condprob

The problem is that you are you using some of Spade's "modules" 
without using Spade itself (which does the necessary initialization). 
That is, you didn't include a 'preprocessor spade:' line, but you did 
have 'preprocessor spade-*:' lines.  Add the 'preprocessor spade:' 
line and your problem should go away.

When we do some more Spade development in a couple months, I plan to 
restructure the code a bit to give a better error message in this 
case.

Best regards,

   Jim
-- 
|*      Jim Hoagland, Associate Researcher, Silicon Defense      *|
|*            --- Silicon Defense: IDS Solutions ---             *|
|*  hoagland at ...60..., http://www.silicondefense.com/  *|
|*   Voice: (530) 756-7317                 Fax: (530) 756-7297   *|




More information about the Snort-devel mailing list