Re: [Snort-users] snort keeps dying!!!

permalink · #1 (**permalink**) 09-06-2007

--===============1961246926==
Content-Type: multipart/alternative;
boundary="_2012f70a-58e0-46ce-9ba3-32cfe7a5da0d_"

--_2012f70a-58e0-46ce-9ba3-32cfe7a5da0d_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

The better questions:
=0A=

=0A=
Are you trying to run ALL SIGNATURES (including bleeding threats, and the S=
tormworm IP Signatures, about 15,000 signatures)??
=0A=

=0A=
How much bandwidth is this firewall handling? (Mb/s)
=0A=

=0A=
Run Snort in non-daemon mode, and see the error you get when it stops runni=
ng.=20
=0A=

=0A=
=0A=

Shirkdog
=0A=
' or 1=3D1-- =0A=
=0A=

=0A=
http://www.shirkdog.us
> Date: Thu, 6 Sep 2007 12:20:32 -0400
> From: joel.esler@sourcefire.com
> To: titanyen2000@yahoo.com; snort-users@lists.sourceforge.net
> Subject: Re: [Snort-users] snort keeps dying!!!
>=20
> We'll probably need some kind of debug output to find out why it's dying
> since it's not printing any error messages.
>=20
> Are you running out of RAM on the box when Snort dies?
>=20
> J
>=20
>=20
> On 9/6/07 12:16 PM, "Zakai Kinan" <titanyen2000@yahoo.com> mentioned to m=
e:
>=20
> > The firewall is using Debian Etch 4.1. It is a Dell
> > PE 2950. I have nothing in the logs. Version 2.6.1.5
> > worked fine until I upgraded to latest version.
> >=20
> >=20
> > ZK
> > =20
> > --- Joel Esler <joel.esler@sourcefire.com> wrote:
> >=20
> >> What OS? What hardware? Do you have anything in
> >> your system log?
> >>=20
> >> Joel
> >>=20
> >>=20
> >> On 9/6/07 11:57 AM, "Zakai Kinan"
> >> <titanyen2000@yahoo.com> mentioned to me:
> >>=20
> >>> I just upgraded from 2.6.1.5 to 2.7.0.1 and now
> >> snort
> >>> keeps dying with no error messages. I am using
> >>> snortsam, flex_resp2, and react. I have lowered
> >> the
> >>> memory config to lowmem. The firewall has two
> >> cpus
> >>> and 4GB of ram. I start the daemaon and 2 minutes
> >>> later it stops suddenly. Has anyone else
> >> encounter
> >>> this problem?
> >>>=20
> >>> TIA,
> >>>=20
> >>> ZK
> >>>=20
> >>>=20
> >>> =20
> >>>=20
> >>=20
> > __________________________________________________ _____________________=
_______
> >>> ______
> >>> Need a vacation? Get great deals
> >>> to amazing places on Yahoo! Travel.
> >>> http://travel.yahoo.com/
> >>>=20
> >>>=20
> >>=20
> > -----------------------------------------------------------------------=
--
> >>> This SF.net email is sponsored by: Splunk Inc.
> >>> Still grepping through log files to find problems?
> >> Stop.
> >>> Now Search log events and configuration files
> >> using AJAX and a browser.
> >>> Download your FREE copy of Splunk now >>
> >> http://get.splunk.com/
> >>> _______________________________________________
> >>> Snort-users mailing list
> >>> Snort-users@lists.sourceforge.net
> >>> Go to this URL to change user options or
> >> unsubscribe:
> >>>=20
> >>=20
> > https://lists.sourceforge.net/lists/...fo/snort-users
> >>> Snort-users list archive:
> >>>=20
> >>=20
> > http://www.geocrawler.com/redir-sf.p...=3Dsnort-users
> >>>=20
> >>=20
> >> --
> >> joel esler | security consultant | Sourcefire | pgp
> >> is public
> >>=20
> >>=20
> >>=20
> >=20
> >=20
> >=20
> > =20
> > __________________________________________________ _____________________=
_______
> > ______
> > Shape Yahoo! in your own image. Join our Network Research Panel today!
> > http://surveylink.yahoo.com/gmrs/yah...vite.asp?a=3D7
> >=20
> >=20
> >=20
> > -----------------------------------------------------------------------=
--
> > This SF.net email is sponsored by: Splunk Inc.
> > Still grepping through log files to find problems? Stop.
> > Now Search log events and configuration files using AJAX and a browser.
> > Download your FREE copy of Splunk now >> http://get.splunk.com/
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users@lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/...fo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.p...=3Dsnort-users
> >=20
>=20
> --
> joel esler | security consultant | Sourcefire | pgp is public
>=20
>=20
>=20
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems? Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >> http://get.splunk.com/
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.p...=3Dsnort-users

__________________________________________________ _______________
Connect to the next generation of MSN Messenger=A0
http://imagine-msn.com/messenger/lau...3Den-us&sourc=
e=3Dwlmailtagline=

--_2012f70a-58e0-46ce-9ba3-32cfe7a5da0d_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<style>
..hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class=3D'hmmessage'><div style=3D"text-align: left;"> </div> <d=
iv style=3D"text-align: left;">The better questions: =0A=
 =0A=
Are you trying to run ALL SIGNATURES (including bleeding threats, and the S=
tormworm IP Signatures, about 15,000 signatures)?? =0A=
 =0A=
How much bandwidth is this firewall handling? (Mb/s) =0A=
 =0A=
Run Snort in non-daemon mode, and see the error you get when it stops runni=
ng. =0A=
 =0A=
</div>=0A=
 Shirkdog =0A=
' or 1=3D1-- =0A=
=0A=
 =0A=
http://www.shirkdog.us <hr id=3D"stopSpelling">> Date: Thu, 6 Sep 200=
7 12:20:32 -0400 > From: joel.esler@sourcefire.com > To: titany=
en2000@yahoo.com; snort-users@lists.sourceforge.net > Subject: Re: [S=
nort-users] snort keeps dying!!! > > We'll probably need some =
kind of debug output to find out why it's dying > since it's not prin=
ting any error messages. > > Are you running out of RAM on the=
box when Snort dies? > > J > > > On 9/6/0=
7 12:16 PM, "Zakai Kinan" <titanyen2000@yahoo.com> mentioned to me:<b=
r>> > > The firewall is using Debian Etch 4.1. It is a Dell<b=
r>> > PE 2950. I have nothing in the logs. Version 2.6.1.5 > =
> worked fine until I upgraded to latest version. > > > =
> > > ZK > > > > --- Joel Esler <joel.=
esler@sourcefire.com> wrote: > > > >> What OS? Wh=
at hardware? Do you have anything in > >> your system log? =
> >> > >> Joel > >> > >> <br=
>> >> On 9/6/07 11:57 AM, "Zakai Kinan" > >> <titan=
yen2000@yahoo.com> mentioned to me: > >> > >>&g=
t; I just upgraded from 2.6.1.5 to 2.7.0.1 and now > >> snort<b=
r>> >>> keeps dying with no error messages. I am using >=
>>> snortsam, flex_resp2, and react. I have lowered > >=
> the > >>> memory config to lowmem. The firewall has tw=
o > >> cpus > >>> and 4GB of ram. I start the d=
aemaon and 2 minutes > >>> later it stops suddenly. Has any=
one else > >> encounter > >>> this problem? &=
gt; >>> > >>> TIA, > >>> > &=
gt;>> ZK > >>> > >>> > >>=
> > >>> > >> > > _________=
__________________________________________________ ___________________ &g=
t; >>> ______ > >>> Need a vacation? Get great deal=
s > >>> to amazing places on Yahoo! Travel. > >>=
> http://travel.yahoo.com/ > >>> > >>> <b=
r>> >> > > ---------------------------------------------=
---------------------------- > >>> This SF.net email is spon=
sored by: Splunk Inc. > >>> Still grepping through log files=
to find problems? > >> Stop. > >>> Now Search =
log events and configuration files > >> using AJAX and a browse=
r. > >>> Download your FREE copy of Splunk now >> &=
gt; >> http://get.splunk.com/ > >>> __________________=
_____________________________ > >>> Snort-users mailing list=
 > >>> Snort-users@lists.sourceforge.net > >>&gt=
; Go to this URL to change user options or > >> unsubscribe:<br=
>> >>> > >> > > https://lists.sourceforg=
e.net/lists/listinfo/snort-users > >>> Snort-users list arch=
ive: > >>> > >> > > http://www.geocra=
wler.com/redir-sf.php3?list=3Dsnort-users > >>> > &gt=
;> > >> -- > >> joel esler | security consultan=
t | Sourcefire | pgp > >> is public > >> > &=
gt;> > >> > > > > > > &gt=
; > > > ________________________________________________=
______________________________ > > ______ > > Shape Yahoo=
! in your own image. Join our Network Research Panel today! > > h=
ttp://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=3D7 > > <=
br>> > > > > > ----------------------------------=
--------------------------------------- > > This SF.net email is s=
ponsored by: Splunk Inc. > > Still grepping through log files to f=
ind problems? Stop. > > Now Search log events and configuration f=
iles using AJAX and a browser. > > Download your FREE copy of Splu=
nk now >> http://get.splunk.com/ > > ______________________=
_________________________ > > Snort-users mailing list > &gt=
; Snort-users@lists.sourceforge.net > > Go to this URL to change u=
ser options or unsubscribe: > > https://lists.sourceforge.net/list=
s/listinfo/snort-users > > Snort-users list archive: > > =
http://www.geocrawler.com/redir-sf.php3?list=3Dsnort-users > > <br=
>> > -- > joel esler | security consultant | Sourcefire | p=
gp is public > > > > ---------------------------=
---------------------------------------------- > This SF.net email is=
sponsored by: Splunk Inc. > Still grepping through log files to find=
problems? Stop. > Now Search log events and configuration files usi=
ng AJAX and a browser. > Download your FREE copy of Splunk now >&g=
t; http://get.splunk.com/ > ________________________________________=
_______ > Snort-users mailing list > Snort-users@lists.sourcefo=
rge.net > Go to this URL to change user options or unsubscribe: &g=
t; https://lists.sourceforge.net/lists/listinfo/snort-users > Snort-u=
sers list archive: > http://www.geocrawler.com/redir-sf.php3?list=3Ds=
nort-users <hr />Connect to the next generation of MSN Messenger=
=A0 <a href=3D'http://imagine-msn.com/messenger/launch80/default.aspx?loca=
le=3Den-us&source=3Dwlmailtagline' target=3D'_new'>Get it now! </a></body>
</html>=

--_2012f70a-58e0-46ce-9ba3-32cfe7a5da0d_--

--===============1961246926==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
--===============1961246926==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users
--===============1961246926==--

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode