[Snort-users] 2GB limit?

Erick Mechler emechler at ...7719...
Thu Jan 9 11:05:07 EST 2003

:: Has anyone else run into any problems where logging in tcpdump format
:: stops once the log file reaches 2GB?  I'm using Snort 1.8.6 (Build 105) on
:: a Redhat 7.2 box with kernel 2.4.7-10.

Older implementations of the ext2 filesystem had a 2GB file size limit.  I
think 7.2 has a kernel tweak to fix that, though, so I'd check out the
kernel config that you're using to see if it has a 'large_file' support
knob.  Sorry I can't give you more specifics; haven't run Linux in years :)

Cheers - Erick

More information about the Snort-users mailing list