[Snort-users] daemon consuming 100% memory

Matt Kettler mkettler at ...4108...
Mon May 13 08:43:02 EDT 2002

Well, lets see here. a quick rough guide:

1) if you aren't running snort 1.8.6 or better, download and install that. 
from the release notes:
                 * Fixed stream4 several low memory conditions
2) if you have little memory in your system, either buy more ram, or shut 
down unnecessary garbage that a snort sensor doesn't need (ie: xwindows).
3) trim down your ruleset.

If that's not enough info, I agree with Chris:
 >how much memory do you have, what snort version, what configuration options?

Without that information it's impossible to make any kind of reasonable 
estimate of where your problem lies, only broad generalizations.

At 02:24 PM 5/13/2002 +0800, kukulkan wrote:
>Hi all,
>       I am running latest snort, running almost every snort rules, using
>redhat 7.2. My problem is after about 5-6 hours, my snort daemon will
>using 100% memory before it dies. Is this the flaw inside the
>program?How can I prevent the daemon from dying after 5-6 hours?
>Have big pipes? SourceForge.net is looking for download mirrors. We supply
>the hardware. You get the recognition. Email Us: bandwidth at ...382...
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>Snort-users list archive:

More information about the Snort-users mailing list