Home page logo
/

snort logo Snort mailing list archives

Re: Snort gets killed
From: Eric G <eric () nixwizard net>
Date: Fri, 28 Jun 2013 17:32:11 -0400

As Waldo said (and I kinda suspected this too), this is the Linux kernel
built in OOM killer.

Google 'Linux oom killer' if you'd like to know more, but honestly you're
going to need to throw more RAM at the VM to fix this one. It's basically
the kernel picking the snort process out and killing it because it's
consuming all the memory on the box

There's an ever so slight chance that it's a memory leak in snort that's
causing it to get killed as well

--
Eric
http://www.linkedin.com/in/ericgearhart
 On Jun 28, 2013 1:18 PM, "waldo kitty" <wkitty42 () windstream net> wrote:

On 6/28/2013 11:03, Alex Adamos wrote:
these are the log files from both the Host and the guest VM. The guest
VM has
1536 MB RAM.

from syslog, lines 365 and 366...

Jun 27 16:04:27 alex-VirtualBox kernel: [ 6993.710126] Out of memory: Kill
process 4503 (snort) score 773 or sacrifice child
Jun 27 16:04:27 alex-VirtualBox kernel: [ 6993.710141] Killed process 4503
(snort) total-vm:1862572kB, anon-rss:1338588kB, file-rss:12kB

as i previously wrote, your virtual machine is out of memory and has
killed off
snort to be able to have enough memory for continued operations...


--
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.


------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:

Build for Windows Store.

http://p.sf.net/sfu/windows-dev2dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest
Snort news!

------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:

Build for Windows Store.

http://p.sf.net/sfu/windows-dev2dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]