<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I am having issues with Suricata crashing due to running out of memory.<div>I just wanted to clarify certain sections of config that I am doing my calculations correctly. </div><div><br></div><div>max-pending-packets 65000 ------- Does that use a lot of Ram?</div><div><br></div><div>So for defrag and flow sections, whatever memcap values I set, that's what the maximum that can be used, correct?</div><div><br></div><div>Stream section is a bit unclear to me. Memcap for Stream and Memcap for Reassembly, how do they relate? Which one should be bigger?</div><div><br></div><div>Host section, once again, memcap is the maximum RAM that would be used?</div><div><br></div><div>And lastly, libhtp section, request and response -body-limit values, is that maximum memory utilization of LIBHTP?</div><div><br></div><div>Thanks.</div><div><br></div><div><br></div><div><br></div> </div></body>
</html>