[Snort-users] S5: Session exceeded & Pruned session

Anshuman Anil Deshmukh anshuman at ...16510...
Thu Jul 10 08:55:54 EDT 2014


In our Snort setup we see messages "S5: Session exceeded configured & S5 Pruned session" (refer screenshot below). Could you please let us know if getting these messages is normal or if any action is required on this.

Will there be any events that SNORT would not be capture due to this error?

We use Snort version 2.9.5 GRE (Build 103)

Following options are set in the snort.conf

config event_queue: max_queue 8 log 5 order_events content_length

max_queued_bytes 1073741824


"Legal Disclaimer: This electronic message and all contents contain information from Cybage Software Private Limited which may be privileged, confidential, or otherwise protected from disclosure. The information is intended to be for the addressee(s) only. If you are not an addressee, any disclosure, copy, distribution, or use of the contents of this message is strictly prohibited. If you have received this electronic message in error please notify the sender by reply e-mail to and destroy the original message and all copies. Cybage has taken every reasonable precaution to minimize the risk of malicious content in the mail, but is not liable for any damage you may sustain as a result of any malicious content in this e-mail. You should carry out your own malicious content checks before opening the e-mail or attachment." 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20140710/3343969f/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 50929 bytes
Desc: image002.png
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20140710/3343969f/attachment.png>

More information about the Snort-users mailing list