[Snort-users] [RGSPAM] Re: snort process getting killed

Matt Kettler mkettler at ...4108...
Wed May 16 13:48:20 EDT 2007


Joel Esler wrote:
> I am sure you mean that Snort 'dies' as opposed to it getting killed. (Correct?)

In the first post of the thread, Doug identifies it as being killed with
SIGSEGV, at least according to truss. (Solaris equivalent of strace, AFAIK)

---------------------
451:        Incurred fault #6, FLTBOUNDS  %pc = 0x08072EB1
451:          siginfo: SIGSEGV SEGV_MAPERR addr=0x00000001
451:        Received signal #11, SIGSEGV [default]
451:          siginfo: SIGSEGV SEGV_MAPERR addr=0x00000001
451:            *** process killed ***
---------------------

> 
> What do your logs say (/var/log/messages commonly)?  Anything?
> 
> 
> On Wed, May 16, 2007 at 12:13:29PM -0400, it looks like doug schmidt sent me:
>> Have gone through acs, ac, and lowmem so far. On acs/ac snort gets
>> kill around 10-15 minutes later. With lowmem, it was killed within a
>> minute or two.
>>
>> ~doug




More information about the Snort-users mailing list