[Snort-users] Question

Gibson, Nathan J. (HSC) Nathan-Gibson at ...15095...
Mon Jul 18 10:42:57 EDT 2011

I have been running snort for over a year now. Nothing has changed in my configuration (except new rules). I have been running the same rule categories for a year. All of the sudden (about a month ago) snort started randomly stopping with no apparent errors in the logs. The only error I get is when I try to restart snort I get the following error.

7/18/2011 9:33 AM :   snort[7491]: FATAL ERROR: Can't start DAQ (-1) - can't mmap rx ring: Cannot allocate memory!

As I said the only variable I have are the actual rules that are updated from ET and Sourcefire. Could a rule be causing this?

Here are the stats on my snort config:

   ,,_     -*> Snort! <*-
  o"  )~   Version IPv6 GRE (Build 135)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
           Copyright (C) 1998-2011 Sourcefire, Inc., et al.
           Using libpcap version 1.1.1
           Using PCRE version: 6.6 06-Feb-2006
           Using ZLIB version: 1.2.3

PCAP_MEMORY=6120 PCAP_FRAMES=65535 /usr/local/bin/snort -c /etc/snort/snort.conf -i eth1 -D

top - 09:41:21 up 2 days, 24 min,  1 user,  load average: 0.14, 0.24, 0.22
Tasks: 383 total,   1 running, 382 sleeping,   0 stopped,   0 zombie
Cpu(s):  0.2%us,  0.1%sy,  0.0%ni, 99.6%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
Mem:  12462404k total,   470188k used, 11992216k free,     1056k buffers
Swap:  1020116k total,        0k used,  1020116k free,   260968k cached
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20110718/218c53d0/attachment.html>

More information about the Snort-users mailing list