[Snort-devel] old problem seems back

Kreimendahl, Chad J Chad.Kreimendahl at ...1167...
Tue Oct 15 08:10:03 EDT 2002


 
I did just try using truss to figure out the info you wanted.... unfortunately, when it locks up into 100% cpu usage, it returns nothing... everything looks fine before it does that... can see all the calls.

	-----Original Message----- 
	From: Chris Green [mailto:cmg at ...835...] 
	Sent: Sun 10/13/2002 6:44 PM 
	To: Kreimendahl, Chad J 
	Cc: snort-devel at lists.sourceforge.net 
	Subject: Re: [Snort-devel] old problem seems back
	
	

	"Kreimendahl, Chad J" <Chad.Kreimendahl at ...1167...> writes:
	
	> I'm not sure if anyone else experienced this in the past, but for us
	> it's come back again.  There is a system on which we run multiple
	> instances of snort, some of which get high amounts of packets flying
	> their way every so often.  If the CPU utilization is at 100% for
	> extended periods of time, one or several of the snort processes will
	> begin to hijack the CPU and try to steal ALL of its cycles.  Currently
	> it's not based on whether or not it was the snort that started the CPU
	> usage with all the packets, it's just random.  Now, I say this having to
	> note one other thing.  Along with this wonderful use of resources comes
	> a failing of snort to log any of the alerts.
	
	Try strace -p <snort pid> and see what function it's stuck in. It's
	
	Try disableing portscan2 and conversation and see if you can repeat it
	--
	Chris Green <cmg at ...402...>
	I've had a perfectly wonderful evening. But this wasn't it.
	     -- Groucho Marx
	
	
	-------------------------------------------------------
	This sf.net email is sponsored by:ThinkGeek
	Welcome to geek heaven.
	http://thinkgeek.com/sf
	_______________________________________________
	Snort-devel mailing list
	Snort-devel at lists.sourceforge.net
	https://lists.sourceforge.net/lists/listinfo/snort-devel
	

-------------- next part --------------
A non-text attachment was scrubbed...
Name: winmail.dat
Type: application/ms-tnef
Size: 5082 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20021015/72371300/attachment.bin>


More information about the Snort-devel mailing list