[Snort-devel] old problem seems back

Kreimendahl, Chad J Chad.Kreimendahl at ...1167...
Tue Oct 15 08:23:14 EDT 2002

The strace running on our systems appears not to work, and is absent a manpage.  Will try to install the strace I found on sourceforge and see if it likes me better.

	-----Original Message----- 
	From: Chris Green [mailto:cmg at ...835...] 
	Sent: Sun 10/13/2002 6:44 PM 
	To: Kreimendahl, Chad J 
	Cc: snort-devel at lists.sourceforge.net 
	Subject: Re: [Snort-devel] old problem seems back

	"Kreimendahl, Chad J" <Chad.Kreimendahl at ...1167...> writes:
	> I'm not sure if anyone else experienced this in the past, but for us
	> it's come back again.  There is a system on which we run multiple
	> instances of snort, some of which get high amounts of packets flying
	> their way every so often.  If the CPU utilization is at 100% for
	> extended periods of time, one or several of the snort processes will
	> begin to hijack the CPU and try to steal ALL of its cycles.  Currently
	> it's not based on whether or not it was the snort that started the CPU
	> usage with all the packets, it's just random.  Now, I say this having to
	> note one other thing.  Along with this wonderful use of resources comes
	> a failing of snort to log any of the alerts.
	Try strace -p <snort pid> and see what function it's stuck in. It's
	Try disableing portscan2 and conversation and see if you can repeat it
	Chris Green <cmg at ...402...>
	I've had a perfectly wonderful evening. But this wasn't it.
	     -- Groucho Marx
	This sf.net email is sponsored by:ThinkGeek
	Welcome to geek heaven.
	Snort-devel mailing list
	Snort-devel at lists.sourceforge.net

-------------- next part --------------
A non-text attachment was scrubbed...
Name: winmail.dat
Type: application/ms-tnef
Size: 5014 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20021015/9121fb24/attachment.bin>

More information about the Snort-devel mailing list