[Snort-devel] old problem seems back
cmg at ...835...
Mon Oct 14 06:12:06 EDT 2002
"Kreimendahl, Chad J" <Chad.Kreimendahl at ...1167...> writes:
> I'm not sure if anyone else experienced this in the past, but for us
> it's come back again. There is a system on which we run multiple
> instances of snort, some of which get high amounts of packets flying
> their way every so often. If the CPU utilization is at 100% for
> extended periods of time, one or several of the snort processes will
> begin to hijack the CPU and try to steal ALL of its cycles. Currently
> it's not based on whether or not it was the snort that started the CPU
> usage with all the packets, it's just random. Now, I say this having to
> note one other thing. Along with this wonderful use of resources comes
> a failing of snort to log any of the alerts.
Try strace -p <snort pid> and see what function it's stuck in. It's
Try disableing portscan2 and conversation and see if you can repeat it
Chris Green <cmg at ...402...>
I've had a perfectly wonderful evening. But this wasn't it.
-- Groucho Marx
More information about the Snort-devel