[Snort-devel] possible memory leak in 2.2.0RC1

Joshua Fritsch lucid at ...2597...
Mon Aug 9 06:26:03 EDT 2004


Jeremy Hewlett sent me a patch which I assume contained the same fix you
reference. All seems to be well now.

Thanks!!

-J


On Wed, 4 Aug 2004, Daniel Roelker wrote:

> This was fixed in the cvs branch of SNORT_2_2 for the stable release.
> If you could check out the most recent version of 2.2 from cvs (-r
> SNORT_2_2) and let me know if that has fixed your problem, that would be
> great.
>
> Thanks,
> Dan
>
> On Wed, 2004-08-04 at 13:29, Joshua Fritsch wrote:
> > Hello,
> >
> > After upgrading to snort 2.2.0RC1 we started seeing frequent crashes due
> > to what seems to be a memory leak. If monitoring via top you can watch the
> > usage go from zero to over 100MB in just a few minutes when loading only
> > two rules (same behavior when loading full rule set). Once the system runs
> > out of physical memory, snort dies.
> >
> > Below is the information requested in the BUGS file - - please let me know
> > if I can be of further assistance.
> >
> > -J
> >
> > ####################################
> >
> > * OpenBSD 3.2 on x86
> > * Snort v2.2.0RC1
> > * Standard rule set (dl from snort.org)
> > * Preprocessors:
> > preprocessor frag2
> > preprocessor stream4: disable_evasion_alerts
> > preprocessor stream4_reassemble
> > preprocessor telnet_decode
> > preprocessor rpc_decode: 111 32771
> > preprocessor bo
> > preprocessor flow: stats_interval 0 hash 2
> >
> > * Using the DB output plugin for MySQL backend (tried with and without)
> > * Called via the following strings (tried both):
> >
> > snort -c /path/to/snort -u snort -g snort -dev -l /path/to/log -i fxp1 -D
> > snort -c /path/to/snort -u snort -g snort -l /path/to/log -b -i fxp1 -D
> >
> > * Taken from /var/log/messages:
> >
> > Aug  4 12:06:05 nyids1 snort: FATAL ERROR: Unable to allocate memory!
> > (67658 bytes in use)
> >
> > * No core file
> >
> >
> >
> > -------------------------------------------------------
> > This SF.Net email is sponsored by OSTG. Have you noticed the changes on
> > Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
> > one more big change to announce. We are now OSTG- Open Source Technology
> > Group. Come see the changes on the new OSTG site. www.ostg.com
> > _______________________________________________
> > Snort-devel mailing list
> > Snort-devel at lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/snort-devel
> >
> --
> Daniel Roelker
> Software Developer
> Sourcefire, Inc.
>
>




More information about the Snort-devel mailing list