[Snort-users] Snort gets killed

Eric G eric at ...15503...
Fri Jun 28 17:32:11 EDT 2013


As Waldo said (and I kinda suspected this too), this is the Linux kernel
built in OOM killer.

Google 'Linux oom killer' if you'd like to know more, but honestly you're
going to need to throw more RAM at the VM to fix this one. It's basically
the kernel picking the snort process out and killing it because it's
consuming all the memory on the box

There's an ever so slight chance that it's a memory leak in snort that's
causing it to get killed as well

--
Eric
http://www.linkedin.com/in/ericgearhart
 On Jun 28, 2013 1:18 PM, "waldo kitty" <wkitty42 at ...14940...> wrote:

> On 6/28/2013 11:03, Alex Adamos wrote:
> > these are the log files from both the Host and the guest VM. The guest
> VM has
> > 1536 MB RAM.
>
> from syslog, lines 365 and 366...
>
> Jun 27 16:04:27 alex-VirtualBox kernel: [ 6993.710126] Out of memory: Kill
> process 4503 (snort) score 773 or sacrifice child
> Jun 27 16:04:27 alex-VirtualBox kernel: [ 6993.710141] Killed process 4503
> (snort) total-vm:1862572kB, anon-rss:1338588kB, file-rss:12kB
>
> as i previously wrote, your virtual machine is out of memory and has
> killed off
> snort to be able to have enough memory for continued operations...
>
>
> --
> NOTE: No off-list assistance is given without prior approval.
>        Please keep mailing list traffic on the list unless
>        private contact is specifically requested and granted.
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Windows:
>
> Build for Windows Store.
>
> http://p.sf.net/sfu/windows-dev2dev
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130628/8b8070ee/attachment.html>


More information about the Snort-users mailing list