<br><br><div class="gmail_quote">On Tue, Aug 2, 2011 at 12:26 PM, Pablo <span dir="ltr"><<a href="mailto:pablo.rincon.crespo@gmail.com">pablo.rincon.crespo@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
2011/8/2 Peter Manev <<a href="mailto:petermanev@gmail.com">petermanev@gmail.com</a>>:<br>
<div><div></div><div class="h5">><br>
><br>
> On Mon, Aug 1, 2011 at 11:01 PM, Fernando Ortiz <<a href="mailto:fernando.ortiz.f@gmail.com">fernando.ortiz.f@gmail.com</a>><br>
> wrote:<br>
>><br>
>> The problem is not at startup, It runned find for about 30 seconds until<br>
>> it crashed with that error. I can't reproduce the error with the same<br>
>> conditions of traffic right now because I was testing the IPS in production<br>
>> environment which I can only work with pass midnight (still a good througput<br>
>> to test ~200Mbps)<br>
>> I will try reproducing the error with stress tools in the meantime. Thanks<br>
>> in advance<br>
>><br>
>> 2011/8/1 Peter Manev <<a href="mailto:petermanev@gmail.com">petermanev@gmail.com</a>><br>
>>><br>
>>><br>
>>> On Mon, Aug 1, 2011 at 7:54 PM, Will Metcalf <<a href="mailto:william.metcalf@gmail.com">william.metcalf@gmail.com</a>><br>
>>> wrote:<br>
>>>><br>
>>>> looks like a bug to me. Did this produce a core dump? If so can you<br>
>>>> open a ticket and paste the output of...<br>
>>>><br>
>>>> gdb /path/to/suri/bin core.file<br>
>>>> bt full<br>
>>>><br>
>>>> If you don't have a core dump and you can reproduce the bug, having a<br>
>>>> packet capture and running suri with<br>
>>>><br>
>>>> ulimit -c unlimited; /path/to/suri -c suricata.yaml <other opts><br>
>>>><br>
>>>> to get a coredump would be helpful.<br>
>>>><br>
>>>> On Mon, Aug 1, 2011 at 12:43 PM, Fernando Ortiz<br>
>>>> <<a href="mailto:fernando.ortiz.f@gmail.com">fernando.ortiz.f@gmail.com</a>> wrote:<br>
>>>> > Jul 29 04:49:05 ips1 kernel: Decode1[31747]: segfault at 7fc3fe85cc6f<br>
>>>> > ip<br>
>>>> > 00000000004f0de9 sp 00007fc2fe85c230 error 4 in<br>
>>>> > suricata[400000+12f000]<br>
>>>> > I don't know what this error means, but it happens when I change the<br>
>>>> > midstream option in suricata.yaml<br>
>>>> > // /etc/suricata/suricata.yaml<br>
>>>> > memcap: 567554432<br>
>>>> > max_sessions: 550000<br>
>>>> > checksum_validation: no # reject wrong csums<br>
>>>> > # midstream : false<br>
>>>> > midstream : true<br>
>>>> > async_oneside: true<br>
>>>> > inline: yes # no inline mode<br>
>>>> > Not sure if it is a bug or something misconfigured at my side.<br>
>>>> ><br>
>>>> > _______________________________________________<br>
>>>> > Oisf-users mailing list<br>
>>>> > <a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
>>>> > <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
>>>> ><br>
>>>> ><br>
>>>> _______________________________________________<br>
>>>> Oisf-users mailing list<br>
>>>> <a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
>>>> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
>>><br>
>>><br>
>>> I just made my config to exactly look like your changes - but Suri starts<br>
>>> fine, no problem.<br>
>>> 1.1beta2 (rev b3f7e6a)<br>
>>><br>
>>> Thanks<br>
>>><br>
>>><br>
>>> --<br>
>>> Peter Manev<br>
>><br>
>><br>
>><br>
>> --<br>
>> Fernando Ortiz<br>
>> Twitter: <a href="http://twitter.com/FernandOrtizF" target="_blank">http://twitter.com/FernandOrtizF</a><br>
>><br>
>><br>
>> _______________________________________________<br>
>> Oisf-users mailing list<br>
>> <a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
>> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
>><br>
> I just run it for the whole night - it didn't crash.<br>
> hmmm ...<br>
><br>
><br>
> --<br>
> Peter Manev<br>
><br>
> _______________________________________________<br>
> Oisf-users mailing list<br>
> <a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
><br>
><br>
<br>
</div></div>Hi Peter,<br>
as of the output of the segfault, Fernando's box is 64bit arch. What<br>
arch are you using? Also, consider that your traffic type and<br>
throughtput will not be the same as Fernando's, so it can be normal<br>
that it doesn't crash in your environment. I think we should wait to<br>
see if Fernando can reproduce it and throw some light to the<br>
conditions that trigger it.<br>
<br>
<br>
--<br>
<br>
Best regards,<br>
<font color="#888888"><br>
--<br>
Pablo Rincon<br>
@PabloForThePPL<br>
------------------------------------<br>
</font></blockquote></div><br>I agree.<br>Mine is 32 bit and it does not get anywhere near the traffic Fernando's box gets.<br><br>Thanks<br clear="all"><br>-- <br>Peter Manev<br>