[Snort-users] Memory Leak
maillist at ...6454...
Fri Jul 11 14:23:01 EDT 2003
----- Original Message -----
From: "Erek Adams" <erek at ...950...>
To: "Jim Gifford" <maillist at ...6454...>
Cc: <Snort-users at lists.sourceforge.net>
Sent: Friday, July 11, 2003 11:31 AM
Subject: Re: [Snort-users] Memory Leak
> On Fri, 11 Jul 2003, Jim Gifford wrote:
> > I have been experience a memory leak on my system, I have tracked it
> > down to snort. Here is the problem the way I see it.
> > snort starts out running on my system at 40mb.
> > 3202 root 9 0 43580 40m 1152 S 0.0 4.0 0:05.66 snort
> > After a day of running and a half of running snort goes up to 140+mb and
> > locks the system up.
> > Any suggestions or patches.
> > Snort was compiled from the source.
> hrm... You may not actually have a leak. I've got a copy of Snort that's
> been running since Jun 19, and it's at a constant 69MB.
> root 17319 0.0 26.5 69000 68936 C0 S+ 19Jun03 2:51.49
> 2.0 has a much larger memory footprint, especially if you are uing
> spp_conversation and spp_portscan2. Have you tried just letting it run?
> It might get to some large amount and then stop. You might also want to
> chech out the memory cap functions of spp_conversation.
> Erek Adams
> "When things get weird, the weird turn pro." H.S. Thompson
Here is what I actually see after running a few hours
USER PID %CPU %MEM VSZ RSS TTY STAT START
root 4152 3.3 15.1 165456 156344 ? S
13:28 1:34 snort -c /etc/snort/snort.conf -D -o
More information about the Snort-users