Snort mailing list archives
Snort 3.0 occasionaly coredumps (SIGSEGV), traces included
From: Alan Kayahan via Snort-users <snort-users () lists snort org>
Date: Fri, 20 Jul 2018 15:30:11 +0200
Distributor ID: Ubuntu
Description: Ubuntu 16.04.4 LTS
Release: 16.04
Codename: xenial
,,_ -*> Snort++ <*-
o" )~ Version 3.0.0 (Build 245) from 2.9.11
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2018 Cisco and/or its affiliates. All rights
reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 2.2.2
Using LuaJIT version 2.0.4
Using OpenSSL 1.0.2g 1 Mar 2016
Using libpcap version 1.7.4
Using PCRE version 8.38 2015-11-23
Using ZLIB version 1.2.8
Using FlatBuffers 1.8.0
Using Hyperscan version 4.7.0 2018-05-30
Using LZMA version 5.1.0alpha
Above is the setup we are using, plus the latest OpenAppID database. It
operates inline with NFQ.
Following are couple of stack traces.
PID: 16540 (snort)
UID: 0 (root)
GID: 0 (root)
Signal: 11 (SEGV)
Timestamp: Wed 2018-07-11 23:54:27 UTC (1 weeks 1 days ago)
Command Line: /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua -R
/usr/local/etc/snort/rules/local.rules --plugin-path=/usr/local/lib/snort_extra
-Q -D
Executable: /usr/local/bin/snort
Control Group: /
Slice: -.slice
Boot ID: 39148e30bd89408ea9bdd073a5392201
Machine ID: bd068ebb16484c349fa66b8e69e1c05a
Hostname: snort
Message: Process 16540 (snort) of user 0 dumped core.
Stack trace of thread 16547:
#0 0x00007fd3902bc256 _ZNKSt7__cxx1112basic_
stringIcSt11char_traitsIcESaIcEE7compareERKS4_ (libstdc++.so.6)
#1 0x0000000000575843 _ZStltIcSt11char_
traitsIcESaIcEEbRKNSt7__cxx1112basic_stringIT_T0_T1_EESA_ (snort)
#2 0x0000000000575305 _ZNKSt4lessINSt7__
cxx1112basic_stringIcSt11char_traitsIcESaIcEEEEclERKS5_S8_ (snort)
#3 0x0000000000588cf0 _ZNSt8_Rb_treeINSt7__
cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt4pairIKS5_
St6vectorIPN5snort11DataHandlerESaISB_EEESt10_Select1stISE_
ESt4lessIS5_ESaISE_EE14_M_lower_boundEPSt13_Rb_tree_nodeISE_ESN_RS7_ (snort)
#4 0x000000000058803c _ZNSt8_Rb_treeINSt7__
cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt4pairIKS5_
St6vectorIPN5snort11DataHandlerESaISB_EEESt10_Select1stISE_
ESt4lessIS5_ESaISE_EE4findERS7_ (snort)
#5 0x00000000005875cb _ZNSt3mapINSt7__cxx1112basic_
stringIcSt11char_traitsIcESaIcEEESt6vectorIPN5snort11DataHandlerESaIS9_
EESt4lessIS5_ESaISt4pairIKS5_SB_EEE4findERSF_ (snort)
#6 0x0000000000586d8d _ZN5snort7DataBus8_
publishEPKcRNS_9DataEventEPNS_4FlowE (snort)
#7 0x0000000000586823
_ZN5snort7DataBus7publishEPKcRNS_9DataEventEPNS_4FlowE
(snort)
#8 0x000000000058695d
_ZN5snort7DataBus7publishEPKcPNS_6PacketEPNS_4FlowE
(snort)
#9 0x00000000005ecfa0 _ZN5snort5Snort11thread_idleEv
(snort)
#10 0x00000000005d7616 _ZN8Analyzer7analyzeEv (snort)
#11 0x00000000005d73bb _ZN8AnalyzerclEP7Swappert (snort)
#12 0x0000000000547cda _ZSt8__invokeI8AnalyzerJP7SwappertEEN
St9enable_ifIXaaaantsrSt17is_member_pointerIT_E5valuentsrSt11is_functionIS5_
E5valuentsrS7_INSt14remove_pointerIS5_E4typeEE5valueENSt9result_
ofIFRS5_DpOT0_EE4typeEE4typeESE_SH_ (snort)
#13 0x0000000000547c79 _ZNKSt17reference_
wrapperI8AnalyzerEclIJP7SwappertEEENSt9result_ofIFRS0_DpOT_EE4typeES9_
(snort)
#14 0x0000000000547c21 _ZNSt12_Bind_simpleIFSt17reference_
wrapperI8AnalyzerEP7SwappertEE9_M_invokeIJLm0ELm1EEEEvSt12_Index_tupleIJXspT_EEE
(snort)
#15 0x0000000000547ad8 _ZNSt12_Bind_simpleIFSt17reference_
wrapperI8AnalyzerEP7SwappertEEclEv (snort)
#16 0x0000000000547a68 _ZNSt6thread5_ImplISt12_Bind_
simpleIFSt17reference_wrapperI8AnalyzerEP7SwappertEEE6_M_runEv (snort)
#17 0x00007fd390253c80 n/a (libstdc++.so.6)
#18 0x00007fd3918ce6ba start_thread (libpthread.so.0)
#19 0x00007fd38fbcf41d __clone (libc.so.6)
Stack trace of thread 16540:
#0 0x00007fd3918d7c1d __nanosleep (libpthread.so.0)
#1 0x000000000054392c service_check (snort)
#2 0x0000000000543f0d main_loop (snort)
#3 0x0000000000544012 snort_main (snort)
#4 0x00000000005440d9 main (snort)
#5 0x00007fd38fae8830 __libc_start_main (libc.so.6)
#6 0x00000000005421e9 _start (snort)
Refusing to dump core to tty.
Another trace
PID: 13618 (snort)
UID: 0 (root)
GID: 0 (root)
Signal: 11 (SEGV)
Timestamp: Wed 2018-07-11 00:44:51 UTC (1 weeks 2 days ago)
Command Line: /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua -R
/usr/local/etc/snort/rules/local.rules --plugin-path=/usr/local/lib/snort_extra
-Q -D
Executable: /usr/local/bin/snort
Control Group: /
Slice: -.slice
Boot ID: 39148e30bd89408ea9bdd073a5392201
Machine ID: bd068ebb16484c349fa66b8e69e1c05a
Hostname: snort
Message: Process 13618 (snort) of user 0 dumped core.
Stack trace of thread 13625:
#0 0x00007fdbc7dbd256 _ZNKSt7__cxx1112basic_
stringIcSt11char_traitsIcESaIcEE7compareERKS4_ (libstdc++.so.6)
#1 0x0000000000575843 _ZStltIcSt11char_
traitsIcESaIcEEbRKNSt7__cxx1112basic_stringIT_T0_T1_EESA_ (snort)
#2 0x0000000000575305 _ZNKSt4lessINSt7__
cxx1112basic_stringIcSt11char_traitsIcESaIcEEEEclERKS5_S8_ (snort)
#3 0x0000000000588cf0 _ZNSt8_Rb_treeINSt7__
cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt4pairIKS5_
St6vectorIPN5snort11DataHandlerESaISB_EEESt10_Select1stISE_
ESt4lessIS5_ESaISE_EE14_M_lower_boundEPSt13_Rb_tree_nodeISE_ESN_RS7_ (snort)
#4 0x000000000058803c _ZNSt8_Rb_treeINSt7__
cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt4pairIKS5_
St6vectorIPN5snort11DataHandlerESaISB_EEESt10_Select1stISE_
ESt4lessIS5_ESaISE_EE4findERS7_ (snort)
#5 0x00000000005875cb _ZNSt3mapINSt7__cxx1112basic_
stringIcSt11char_traitsIcESaIcEEESt6vectorIPN5snort11DataHandlerESaIS9_
EESt4lessIS5_ESaISt4pairIKS5_SB_EEE4findERSF_ (snort)
#6 0x0000000000586d8d _ZN5snort7DataBus8_
publishEPKcRNS_9DataEventEPNS_4FlowE (snort)
#7 0x0000000000586823
_ZN5snort7DataBus7publishEPKcRNS_9DataEventEPNS_4FlowE
(snort)
#8 0x000000000058695d
_ZN5snort7DataBus7publishEPKcPNS_6PacketEPNS_4FlowE
(snort)
#9 0x00000000005ecfa0 _ZN5snort5Snort11thread_idleEv
(snort)
#10 0x00000000005d7616 _ZN8Analyzer7analyzeEv (snort)
#11 0x00000000005d73bb _ZN8AnalyzerclEP7Swappert (snort)
#12 0x0000000000547cda _ZSt8__invokeI8AnalyzerJP7SwappertEEN
St9enable_ifIXaaaantsrSt17is_member_pointerIT_E5valuentsrSt11is_functionIS5_
E5valuentsrS7_INSt14remove_pointerIS5_E4typeEE5valueENSt9result_
ofIFRS5_DpOT0_EE4typeEE4typeESE_SH_ (snort)
#13 0x0000000000547c79 _ZNKSt17reference_
wrapperI8AnalyzerEclIJP7SwappertEEENSt9result_ofIFRS0_DpOT_EE4typeES9_
(snort)
#14 0x0000000000547c21 _ZNSt12_Bind_simpleIFSt17reference_
wrapperI8AnalyzerEP7SwappertEE9_M_invokeIJLm0ELm1EEEEvSt12_Index_tupleIJXspT_EEE
(snort)
#15 0x0000000000547ad8 _ZNSt12_Bind_simpleIFSt17reference_
wrapperI8AnalyzerEP7SwappertEEclEv (snort)
#16 0x0000000000547a68 _ZNSt6thread5_ImplISt12_Bind_
simpleIFSt17reference_wrapperI8AnalyzerEP7SwappertEEE6_M_runEv (snort)
#17 0x00007fdbc7d54c80 n/a (libstdc++.so.6)
#18 0x00007fdbc93cf6ba start_thread (libpthread.so.0)
#19 0x00007fdbc76d041d __clone (libc.so.6)
Stack trace of thread 13618:
#0 0x00007fdbc93d8c1d __nanosleep (libpthread.so.0)
#1 0x000000000054392c service_check (snort)
#2 0x0000000000543f0d main_loop (snort)
#3 0x0000000000544012 snort_main (snort)
#4 0x00000000005440d9 main (snort)
#5 0x00007fdbc75e9830 __libc_start_main (libc.so.6)
#6 0x00000000005421e9 _start (snort)
Refusing to dump core to tty.
Any ideas?
Regards,
Alan
_______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- Snort 3.0 occasionaly coredumps (SIGSEGV), traces included Alan Kayahan via Snort-users (Jul 20)
- Re: Snort 3.0 occasionaly coredumps (SIGSEGV), traces included Russ via Snort-users (Jul 21)