[Snort-users] Snort dumps core on Solaris 8

Tom Kyle tom at ...2165...
Wed Jun 6 17:27:38 EDT 2001


In my snort.conf, I have defrag, http_decode, portscan, and
portscan-ignorehosts enabled as preprocessors.  No output plugins are
enabled.  

Running it in the foreground (no -D), it complains of a Bus Error.
Checking other projects' lists, I noticed some complaints about the
optimization routines in gcc 2.95.x on Solaris producing similar
problems, so I compiled snort with -O0 (no optimization), rather than
the default -O2.  It's been running for over two hours now without
coring, so I think that this might have done the trick.  

Thanks for the input,

Tom


Thomas Whipp wrote:
> 
> I've been running Snort for about 2 weeks with no
> instability on an Ultra 5 with Solaris 8, I've also tested
> it on Solaris 8 on a Netra T1 and Netra X1 without
> problems... what pre-processors/logging options do you have
> enabled?
> 
>         Tom
> 
> > -----Original Message-----
> > From: Tom Kyle [mailto:tom at ...2165...]
> > Sent: 04 June 2001 19:32
> > To: snort-users at lists.sourceforge.net
> > Subject: [Snort-users] Snort dumps core on Solaris 8
> >
> >
> > I've been trying to use snort 1.7 that I compiled from
> source with gcc
> > 2.95.3 on an Ultra 5 running Solaris 8.  Unfortunately, it
> dumps core
> > after running for some time (usually 30-120 minutes).
> > I'm using 'snort -Afull -c snort.conf -l /snort -d -D' to
> > invoke snort.
> > Is anyone aware of any issues with snort & Solaris 8, and
> if
> > so, of any
> > workarounds?
> >
> > Thanks!
> >
> > Tom
> >
> > --
> >
> > Thomas A. Kyle
> > Network Security Administrator
> > University of Missouri-St. Louis
> > tkyle at ...2166...
> > (314) 516-6012
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > http://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 

Thomas A. Kyle
Network Security Administrator
University of Missouri-St. Louis
tkyle at ...2166...
(314) 516-6012




More information about the Snort-users mailing list