[Snort-users] ACID makes Apache eat tons of RAM

Jyri Hovila jyri.hovila at ...2940...
Sat Oct 13 21:47:01 EDT 2001


Hi everyone!

Didn't find anything about this in the archives.

My setup:

	- OpenBSD 2.9
	- Snort 1.8.1-RELEASE (Build 74)
	- MySQL 11.15 Distrib 3.23.37
	- Apache 1.3.19
	- ACID 0.9.6 b 16

I noticed that refreshing (apparently) any ACID page several times at
short intervals causes Apache to eat up unbelieveable amounts of memory.
Here's a real-life example:

1. Apache is running, ACID has not been used yet:

     49 processes:  1 running, 48 idle
     CPU states:  0.2% user,  0.0% nice,  0.0% system,  0.8% interrupt,
99.1% idle
     Memory: Real: 12M/35M act/tot  Free: 213M  Swap: 23M/256M used/tot
     
       PID USERNAME PRI NICE  SIZE   RES STATE WAIT     TIME    CPU
COMMAND
     21582 mysql      2    0   11M 1852K idle  select   0:48  0.00%
mysqld
     27349 root       2    0 7292K 1472K sleep poll     0:13  0.00%
squid
     21267 root     -16    0 7812K 1672K sleep bpf      0:07  0.00%
snort

2. ACID Maintenance page loaded once:

     52 processes:  1 running, 51 idle
     CPU states:  0.2% user,  0.0% nice,  0.0% system,  0.2% interrupt,
99.7% idle
     Memory: Real: 19M/42M act/tot  Free: 206M  Swap: 23M/256M used/tot
     
       PID USERNAME PRI NICE  SIZE   RES STATE WAIT     TIME    CPU
COMMAND
     21582 mysql      2    0   11M 1936K sleep select   0:49  1.46%
mysqld
      4614 www        2    0 4036K 6352K sleep netio    0:00  1.17%
httpd
     27349 root       2    0 7292K 1492K sleep poll     0:13  0.00%
squid

3. ACID Maintenance page refreshed 10 times with 3 seconds between
reloads:

     52 processes:  2 running, 50 idle
     CPU states: 63.2% user,  0.0% nice, 29.5% system,  1.4% interrupt,
5.9% idle
     Memory: Real: 158M/182M act/tot  Free: 65M  Swap: 23M/256M used/tot
     
       PID USERNAME PRI NICE  SIZE   RES STATE WAIT     TIME    CPU
COMMAND
     10329 www       64    0  147M  138M run   -        0:05 21.39%
httpd
      9287 www       18    0 4304K 6776K sleep lockf    0:15  9.67%
httpd
     21582 mysql      2    0   11M 1944K idle  select   0:54  1.71%
mysqld


Wow! Apache eats almost 150 MB! That's too much I guess...

Anybody got any idea what could be causing this?

- Jyri





More information about the Snort-users mailing list