Re: snort keeps dying!!!

[Zakai Kinan <titanyen2000 () yahoo com>]

No, I am not trying to run all of the sigs.  I have a
long disabled list.  I only run some from bleeding and
snort community.  I get a Segmentation fault error
when not in daemon mode.  I only have a T1 so my
bandwidth usage is limited.  I am not running out of
memory when it stops.  Snort is currently setup with
lowmem config.  I thought of the same thing.  It was
setup as AC in 2.6.1.5 and it worked fine.  


Thanks again,


ZK



--- "M. Shirk" <shirkdog_list () hotmail com> wrote:

> The better questions:
>
>
>
> Are you trying to run ALL SIGNATURES (including
> bleeding threats, and the Stormworm IP Signatures,
> about 15,000 signatures)??
>
>
>
> How much bandwidth is this firewall handling? (Mb/s)
>
>
>
> Run Snort in non-daemon mode, and see the error you
> get when it stops running. 
>
>
>
>
>
> Shirkdog
>
> ' or 1=1-- 
>
>
>
> http://www.shirkdog.us
> > Date: Thu, 6 Sep 2007 12:20:32 -0400
> > From: joel.esler () sourcefire com
> > To: titanyen2000 () yahoo com;
> snort-users () lists sourceforge net
> > Subject: Re: [Snort-users] snort keeps dying!!!
> >
> > We'll probably need some kind of debug output to
> find out why it's dying
> > since it's not printing any error messages.
> >
> > Are you running out of RAM on the box when Snort
> dies?
> > J
> >
> >
> > On 9/6/07 12:16 PM, "Zakai Kinan"
> <titanyen2000 () yahoo com> mentioned to me:
> > > The firewall is using Debian Etch 4.1.  It is a
> Dell
> > > PE 2950.  I have nothing in the logs.  Version
> 2.6.1.5
> > > worked fine until I upgraded to latest version.
> > >
> > >
> > > ZK
> > >   
> > > --- Joel Esler <joel.esler () sourcefire com>
> wrote:
> > > > What OS?  What hardware?  Do you have anything
> in
> > > > your system log?
> > > >
> > > > Joel
> > > >
> > > >
> > > > On 9/6/07 11:57 AM, "Zakai Kinan"
> > > > <titanyen2000 () yahoo com> mentioned to me:
> > > >
> > > > > I just upgraded from 2.6.1.5 to 2.7.0.1 and
> now
> > > > snort
> > > > > keeps dying with no error messages.  I am
> using
> > > > > snortsam, flex_resp2, and react.  I have
> lowered
> > > > the
> > > > > memory config to lowmem.  The firewall has two
> > > > cpus
> > > > > and 4GB of ram.  I start the daemaon and 2
> minutes
> > > > > later it stops suddenly.  Has anyone else
> > > > encounter
> > > > > this problem?
> > > > >
> > > > > TIA,
> > > > >
> > > > > ZK
> > > > >
> > > > >
> > > > >        
______________________________________________________________________________
> > > > > ______
> > > > > Need a vacation? Get great deals
> > > > > to amazing places on Yahoo! Travel.
> > > > > http://travel.yahoo.com/
-------------------------------------------------------------------------
> > > > > This SF.net email is sponsored by: Splunk Inc.
> > > > > Still grepping through log files to find
> problems?
> > > >  Stop.
> > > > > Now Search log events and configuration files
> > > > using AJAX and a browser.
> > > > > Download your FREE copy of Splunk now >>
> > > > http://get.splunk.com/
> > > > >
> _______________________________________________
> > > > > Snort-users mailing list
> > > > > Snort-users () lists sourceforge net
> > > > > Go to this URL to change user options or
> > > > unsubscribe:
> > > > >
https://lists.sourceforge.net/lists/listinfo/snort-users
> > > > > Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > > > >
> > > >
> > > > --
> > > > joel esler | security consultant | Sourcefire |
> pgp
> > > > is public
> > >
> > >
> > >
> > >       
______________________________________________________________________________
> > > ______
> > > Shape Yahoo! in your own image.  Join our
> Network Research Panel today!
> > >
http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7
> > >
-------------------------------------------------------------------------
> > > This SF.net email is sponsored by: Splunk Inc.
> > > Still grepping through log files to find
> problems?  Stop.
> > > Now Search log events and configuration files
> using AJAX and a browser.
> > > Download your FREE copy of Splunk now >> 
> http://get.splunk.com/
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users () lists sourceforge net
> > > Go to this URL to change user options or
> unsubscribe:
> > >
https://lists.sourceforge.net/lists/listinfo/snort-users
> > > Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > >
> >
> > --
> > joel esler | security consultant | Sourcefire |
> pgp is public
> >
-------------------------------------------------------------------------
> > This SF.net email is sponsored by: Splunk Inc.
> > Still grepping through log files to find problems?
>  Stop.
> > Now Search log events and configuration files
> using AJAX and a browser.
> > Download your FREE copy of Splunk now >> 
> http://get.splunk.com/
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or
> unsubscribe:
> >
https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
_________________________________________________________________
> Connect to the next generation of MSN Messenger 
=== message truncated ===>
-------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems? 
> Stop.
> Now Search log events and configuration files using
> AJAX and a browser.
> Download your FREE copy of Splunk now >> 
http://get.splunk.com/>
_______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or
> unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



       
____________________________________________________________________________________
Yahoo! oneSearch: Finally, mobile search 
that gives answers, not web links. 
http://mobile.yahoo.com/mobileweb/onesearch?refer=1ONXIC

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users