[Snort-users] SNORT has memory leak on Linux Red hat 9

ypwhich ypwhich at ...11276...
Fri Feb 27 14:47:06 EST 2004

Chances are Linux and SNORT are behaving.  You may be reading the output
of "free -t" or "procinfo" incorrectly....which is easy to do, especially
if coming to Linux from a Win32s environment.  The two systems manage
memory differently.

Unless you're noticing a major performance hit after killing SNORT,
chances are you're fine.  If you like copy the output of "free -t" to
email after killing SNORT, will have a look at it.


On Wed, 25 Feb 2004, Kumar, Manoj wrote:

> Date: Wed, 25 Feb 2004 17:14:31 -0500
> From: "Kumar, Manoj" <kumarm at ...10805...>
> To: Jeremy Hewlett <jh at ...1935...>, snort-users at lists.sourceforge.net
> Cc: snort-devel at lists.sourceforge.net, snort-announce at lists.sourceforge.net
> Subject: [Snort-users] SNORT has memory leak on Linux Red hat 9
> Hello everybody,
> I am running SNORT ver 2.1.0 to capture data from my giga bit network on RedHat Linux 9 where SNORT is capturing 100MB of data per minute (Lots of data). Problem is that memory usage keeps going as long as SNORT is running.
> WORST thing is that even if you kill the SNORT process, it doesn't release the memory. Memory usage remains as it is.
> Would you guys please help me out? Why SNORT is behaving like this and anybody has noticed this problem?
> Thanks
> Manoj
> -----Original Message-----
> From: Jeremy Hewlett [ mailto:jh at ...1935...]
> Sent: Wednesday, February 25, 2004 4:41 PM
> To: snort-users at lists.sourceforge.net
> Cc: snort-devel at lists.sourceforge.net;
> snort-announce at lists.sourceforge.net
> Subject: [Snort-devel] Snort 2.1.1 final is available!
> Greetings!
> Snort 2.1.1 is now available - Thanks everyone who installed RC1 and
> tried it out! The differences between RC1 and final are minor, and
> include:
> * Documentation updates and fixes by JP Vossen, Felipe Franciosi, and
>   Drew Smith
> * Compiles on Tru64 now - thanks Hari Gopal and Darryl Cook.
> * libintsnort.a is no longer included in compile routine (this is the
>   Solaris "ar" problem some people have had)
> * Snort templates have been updated
> * Fixed issue with CSV not displaying its output correctly - thanks
>   Bill Guyton and Alan Milligan for your fixes.
> * Fixed Flow-Portscan alert-mode bug where only one alert would get
>   generated.  Thanks Kevin Amorin for pointing out the problem and
>   testing the fix.
> * Minor Makefile fix for "unexpected end of line" at the verstuff.pl
>   line when not using GNU "make" on Solaris - Thanks for the report,
>   Chad Kreimendahl.
> * Removed escaping of '%' and '_' characters in MySQL (thanks
>   Kristofer Karas).
> For further info on changes, please review the ChangeLog and
> RELEASE.NOTES, which can be found in the parent directory of the snort
> source.
> Happy Snorting,
> The Snort Team
> -------------------------------------------------------
> SF.Net is sponsored by: Speed Start Your Linux Apps Now.
> Build and deploy apps & Web services for Linux with
> a free DVD software kit from IBM. Click Now!
> http://ads.osdn.com/?ad_id=1356 <http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click> &alloc_id=3438&op=click
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel

ypwhich at ...11276...
SDF Public Access UNIX System - http://sdf.lonestar.org

More information about the Snort-users mailing list