[Snort-users] memory leak in Snort 1.8.7?

Ben Feinstein me at ...6289...
Thu Oct 3 14:47:02 EDT 2002


What output plugin(s) are you using?  From my experience, the postgresql
db output leaks memory pretty badly...

On Thu, 3 Oct 2002, Matthew Harrell wrote:

> Here's my setup:
>
> I'm running Mandrake Linux 9.0 on a Pentium 200 with 64 MB RAM.  I'm
> running snort-1.8.7-3mdk.rpm.  A little while ago, I changed two things.  I
> upgraded from Mandrake Linux 9.0beta2 to 9.0, and I changed the switch port
> that this box is on so that it hears traffic on all of the ports on that
> switch.  Since then, obviously, I've seen greatly increased scans in Snort
> (about 1 to 2 unique IP numbers an hour, but it varies).
>
> Before these two things were changed, Snort ran just fine, not using up a
> significant amount of memory.  Now, Snort gradually consumes all spare RAM
> and VRAM (which is set at 256 MB).  It seems to take about 24 hours for it
> to use up all the swap space.  The system gets gradually slower and slower
> until it's just about unusable.
>
> Now, is this a memory leak, or is Snort just going to need a HUGE amount of
> RAM due to the increased traffic it sees?
>
> -----------------
> Matt Harrell
> Plexus Systems
> mhar at ...7038...
>
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>





More information about the Snort-users mailing list