[Snort-devel] possible memory leak in 2.2.0RC1

Daniel Roelker droelker at ...402...
Wed Aug 4 13:51:01 EDT 2004


This was fixed in the cvs branch of SNORT_2_2 for the stable release. 
If you could check out the most recent version of 2.2 from cvs (-r
SNORT_2_2) and let me know if that has fixed your problem, that would be
great.

Thanks,
Dan

On Wed, 2004-08-04 at 13:29, Joshua Fritsch wrote:
> Hello,
> 
> After upgrading to snort 2.2.0RC1 we started seeing frequent crashes due
> to what seems to be a memory leak. If monitoring via top you can watch the
> usage go from zero to over 100MB in just a few minutes when loading only
> two rules (same behavior when loading full rule set). Once the system runs
> out of physical memory, snort dies.
> 
> Below is the information requested in the BUGS file - - please let me know
> if I can be of further assistance.
> 
> -J
> 
> ####################################
> 
> * OpenBSD 3.2 on x86
> * Snort v2.2.0RC1
> * Standard rule set (dl from snort.org)
> * Preprocessors:
> preprocessor frag2
> preprocessor stream4: disable_evasion_alerts
> preprocessor stream4_reassemble
> preprocessor telnet_decode
> preprocessor rpc_decode: 111 32771
> preprocessor bo
> preprocessor flow: stats_interval 0 hash 2
> 
> * Using the DB output plugin for MySQL backend (tried with and without)
> * Called via the following strings (tried both):
> 
> snort -c /path/to/snort -u snort -g snort -dev -l /path/to/log -i fxp1 -D
> snort -c /path/to/snort -u snort -g snort -l /path/to/log -b -i fxp1 -D
> 
> * Taken from /var/log/messages:
> 
> Aug  4 12:06:05 nyids1 snort: FATAL ERROR: Unable to allocate memory!
> (67658 bytes in use)
> 
> * No core file
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by OSTG. Have you noticed the changes on
> Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
> one more big change to announce. We are now OSTG- Open Source Technology
> Group. Come see the changes on the new OSTG site. www.ostg.com
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> 
-- 
Daniel Roelker
Software Developer
Sourcefire, Inc.





More information about the Snort-devel mailing list