[Snort-users] Memory Leak

Jim Gifford maillist at ...6454...
Fri Jul 11 14:23:01 EDT 2003


----- Original Message ----- 
From: "Erek Adams" <erek at ...950...>
To: "Jim Gifford" <maillist at ...6454...>
Cc: <Snort-users at lists.sourceforge.net>
Sent: Friday, July 11, 2003 11:31 AM
Subject: Re: [Snort-users] Memory Leak


> On Fri, 11 Jul 2003, Jim Gifford wrote:
>
> > I have been experience a memory leak on my system, I have tracked it
> > down to snort. Here is the problem the way I see it.
> >
> > snort starts out running on my system at 40mb.
> >
> > 3202 root       9   0 43580  40m 1152 S  0.0  4.0   0:05.66 snort
> >
> > After a day of running and a half of running snort goes up to 140+mb and
> > locks the system up.
> >
> > Any suggestions or patches.
> >
> > Snort was compiled from the source.
>
> hrm...  You may not actually have a leak.  I've got a copy of Snort that's
> been running since Jun 19, and it's at a constant 69MB.
>
> root     17319  0.0 26.5 69000 68936 C0  S+    19Jun03    2:51.49
> /usr/local/bin/snort
>
> 2.0 has a much larger memory footprint, especially if you are uing
> spp_conversation and spp_portscan2.  Have you tried just letting it run?
> It might get to some large amount and then stop.  You might also want to
> chech out the memory cap functions of spp_conversation.
>
> Cheers!
>
> -----
> Erek Adams
>
>    "When things get weird, the weird turn pro."   H.S. Thompson
>

Here is what I actually see after running a few hours
USER    PID     %CPU %MEM    VSZ            RSS        TTY    STAT START
TIME   COMMAND
root        4152   3.3      15.1           165456       156344   ?         S
13:28       1:34     snort -c /etc/snort/snort.conf -D -o







More information about the Snort-users mailing list