Andrea Venturoli wrote:
> Hello.
>
> A server of mine is running 6.1/amd64 with 1GiB of RAM.
> From time to time swap use will grow enormously and performance will
> suffer from this; also the nightly clamav run will not complete, as the
> process will get killed due to lack of swap space.
> The day after I'll look into top and see this two processes are the
> largest ones:
>> 672 snort 1 -58 0 4007M 62344K bpf 0 8:53 0.00%
>> snort
>> 669 snort 1 -58 0 323M 29704K bpf 1 1:45 0.00%
>> snort
>
I'm having the exact same problem on 6.0/amd64. I commented out the
stream4 preprocessor lines in the snort.conf file and the problem went
away. I just uncommented them this morning, to confirm that that is
what is causing the problem.
It appears that there is a memory leak in the stream4 preprocessor, but
before I report it, I want to confirm that the symptoms are repeatable.
--
Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/