<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I dont know if swap starts to be used by Suricata crashes after couple of days of running.<div>In system logs, I have kernel messages such as this:</div><div><div>kernel: RxPFReth22 invoked oom-killer: gfp_mask=0x201da, order=0, oom_adj=0, oom_score_adj=0</div><div>kernel: RxPFReth22 cpuset=/ mems_allowed=0-1</div><div>kernel: Pid: 60417, comm: RxPFReth22 Not tainted 2.6.32-504.el6.x86_64 #1</div><div><br></div><div>Then after a ton of stack traces and memory errors, I see this:</div><div><div>kernel: Out of memory: Kill process 59782 (Suricata-Main) score 985 or sacrifice child</div><div>Killed process 59782, UID 501, (Suricata-Main) total-vm:135646364kB, anon-rss:108513440kB, file-rss:21329088kB</div></div><div><br></div><div>I wouldnt be suprised that my buffers are set too big.</div><div>I am just not clear on some sections on how much RAM they use.</div><div>and also for stream section, do you need to add memcap and reassembly buffers together or are they part of each other? As far as I understand reassembly buffer needs to be higher than memcap.</div><div><br></div><div>I have 132gb of RAM. When suricata starts, it is using 64gb</div><br><div>> Date: Thu, 20 Nov 2014 18:21:54 +0100<br>> Subject: Re: [Oisf-users] Memory Allocations<br>> From: petermanev@gmail.com<br>> To: coolyasha@hotmail.com<br>> CC: oisf-users@lists.openinfosecfoundation.org<br>> <br>> On Mon, Nov 17, 2014 at 3:45 PM, Yasha Zislin <coolyasha@hotmail.com> wrote:<br>> > I am having issues with Suricata crashing due to running out of memory.<br>> > I just wanted to clarify certain sections of config that I am doing my<br>> > calculations correctly.<br>> ><br>> > max-pending-packets 65000 ------- Does that use a lot of Ram?<br>> ><br>> > So for defrag and flow sections, whatever memcap values I set, that's what<br>> > the maximum that can be used, correct?<br>> ><br>> > Stream section is a bit unclear to me. Memcap for Stream and Memcap for<br>> > Reassembly, how do they relate? Which one should be bigger?<br>> ><br>> > Host section, once again, memcap is the maximum RAM that would be used?<br>> ><br>> > And lastly, libhtp section, request and response -body-limit values, is that<br>> > maximum memory utilization of LIBHTP?<br>> ><br>> > Thanks.<br>> ><br>> <br>> <br>> Hi,<br>> <br>> You mean you are running into swap, correct?<br>> <br>> If you sum up all the memcap values you have given in suricata.yaml -<br>> would that be less than what you actually have as RAM on the server<br>> running Suricata?<br>> <br>> Thank you<br>> <br>> <br>> -- <br>> Regards,<br>> Peter Manev<br></div></div> </div></body>
</html>