Snort mailing list archives
Re: snort 1.9.0 memleaking ?
From: Erek Adams <erek () theadamsfamily net>
Date: Wed, 27 Nov 2002 10:56:24 -0800 (PST)
On Wed, 27 Nov 2002 pilsl () goldfisch at wrote:
I'm just a beginner with snort and installed it about one month ago on a recent linux-system with postgresql-support and query the whole stuff using acid. Today I had to find that one of my two snort-processes on the gateway takes up to 60MB (not shared) which is quite a lot even for a 520-machine. Anyone seen something similar. By now I restarted the daemons and will watch them more closely.
It's not a memleak. It's stream4, conversation and portscan2. They track connections and need a lot of memory to keep all the info in. You can change the memory usage by setting the 'memcap' options in snort.conf for the preprocessor(s) in question. You can also drop the number of conversations that are stored by using 'max_conversations' Cheers! ----- Erek Adams Nifty-Type-Guy TheAdamsFamily.Net ------------------------------------------------------- This SF.net email is sponsored by: Get the new Palm Tungsten T handheld. Power & Color in a compact size! http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort 1.9.0 memleaking ? pilsl (Nov 27)
- RE: snort 1.9.0 memleaking ? Bill Karwisch (Nov 27)
- Re: snort 1.9.0 memleaking ? Erek Adams (Nov 27)
- Re: snort 1.9.0 memleaking ? pilsl (Nov 27)
- Re: snort 1.9.0 memleaking ? Erek Adams (Nov 27)
- Re: snort 1.9.0 memleaking ? twig les (Nov 27)
- RE: snort 1.9.0 memleaking ? Paul D. Shaffer (Nov 27)
- Re: snort 1.9.0 memleaking ? pilsl (Nov 27)
- Re: snort 1.9.0 memleaking ? Jason (Nov 28)