[Snort-users] /var/log/messages filling up

Cynthia Leonard (cyleonar) cyleonar at ...589...
Mon May 18 06:22:27 EDT 2015

Usually once the memcap reaches a certain limit, the sessions get pruned to free some memory. This message gets printed  when x number sessions are pruned and sometimes it can be quickly fill /var/log/messages.
This issue has been addressed in the upcoming version of snort 2.9.x.


From: test engineer [mailto:test12524 at ...11827...]
Sent: Wednesday, May 13, 2015 12:45 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] /var/log/messages filling up

Constant streaming of:

snort[2546]: S5: Pruned 10 sessions from cache for memcap. 1689 ssns remain.  memcap: 8376897/8388608
in the messages file.  Not sure what is causing it.  Suggestions?
Thank you!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150518/b8a7dec7/attachment.html>

More information about the Snort-users mailing list