[Snort-devel] old problem seems back

Chris Green cmg at ...835...
Mon Oct 14 06:12:06 EDT 2002


"Kreimendahl, Chad J" <Chad.Kreimendahl at ...1167...> writes:

> I'm not sure if anyone else experienced this in the past, but for us
> it's come back again.  There is a system on which we run multiple
> instances of snort, some of which get high amounts of packets flying
> their way every so often.  If the CPU utilization is at 100% for
> extended periods of time, one or several of the snort processes will
> begin to hijack the CPU and try to steal ALL of its cycles.  Currently
> it's not based on whether or not it was the snort that started the CPU
> usage with all the packets, it's just random.  Now, I say this having to
> note one other thing.  Along with this wonderful use of resources comes
> a failing of snort to log any of the alerts.

Try strace -p <snort pid> and see what function it's stuck in. It's

Try disableing portscan2 and conversation and see if you can repeat it
-- 
Chris Green <cmg at ...402...>
I've had a perfectly wonderful evening. But this wasn't it.
     -- Groucho Marx




More information about the Snort-devel mailing list