Re: Snort and memory

[Martin Roesch <roesch () sourcefire com>]

Marcin Zurakowski wrote:
> On Wed, 22 Aug 2001, Martin Roesch wrote:
>
> > What output options are you using?
>
> I set something like this:
> # LOGING
> output alert_syslog: LOG_LOCAL6
>
> And in my syslog.conf:
> local6.*                                                /var/log/snort.log
>
> I've just discovered, that crond died...It has never happened before
> installation snort.

Well, Snort doesn't have any interaction with cron, but if your system
is running out of memory that could be a problem.  I don't know why
Snort is using so much memory, we pretty much eliminated all the memory
leaks in the standard loadout.  Having just looked at the default
vision18.conf file from whitehats.com, I see that the default
preprocessor load is out of date, that's probably the problem.  For the
time being, I'd suggest using the snort.conf file that comes with Snort,
and your logging setup.  If you do that and still see excessive memory
usage, let me know.

     -Marty

--
Martin Roesch
roesch () sourcefire com
http://www.sourcefire.com - http://www.snort.org

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users