Gibson, Nathan J. (HSC)
Nathan-Gibson at ...15095...
Mon Jul 18 10:42:57 EDT 2011
I have been running snort for over a year now. Nothing has changed in my configuration (except new rules). I have been running the same rule categories for a year. All of the sudden (about a month ago) snort started randomly stopping with no apparent errors in the logs. The only error I get is when I try to restart snort I get the following error.
7/18/2011 9:33 AM : snort: FATAL ERROR: Can't start DAQ (-1) - can't mmap rx ring: Cannot allocate memory!
As I said the only variable I have are the actual rules that are updated from ET and Sourcefire. Could a rule be causing this?
Here are the stats on my snort config:
,,_ -*> Snort! <*-
o" )~ Version 220.127.116.11 IPv6 GRE (Build 135)
'''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
Copyright (C) 1998-2011 Sourcefire, Inc., et al.
Using libpcap version 1.1.1
Using PCRE version: 6.6 06-Feb-2006
Using ZLIB version: 1.2.3
PCAP_MEMORY=6120 PCAP_FRAMES=65535 /usr/local/bin/snort -c /etc/snort/snort.conf -i eth1 -D
top - 09:41:21 up 2 days, 24 min, 1 user, load average: 0.14, 0.24, 0.22
Tasks: 383 total, 1 running, 382 sleeping, 0 stopped, 0 zombie
Cpu(s): 0.2%us, 0.1%sy, 0.0%ni, 99.6%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 12462404k total, 470188k used, 11992216k free, 1056k buffers
Swap: 1020116k total, 0k used, 1020116k free, 260968k cached
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users