<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Victor,<br><br>Thanks for quick response. Yes, I've reduced stream.prealloc-sessions and Suricata was able to start up.<br><br>It seems to me that we this reduction, I can have bigger packet loss which I am trying to prevent.<br>It used to work just fine with previous versions. <br><br>Also, how can I calculate the highest value that I can use?<br><br>Thanks.<br><br><div>> Date: Tue, 3 Mar 2015 16:08:21 +0100<br>> From: lists@inliniac.net<br>> To: oisf-users@lists.openinfosecfoundation.org<br>> Subject: Re: [Oisf-users] Suricata 2.0.7 fails to start<br>> <br>> On 03/03/2015 04:05 PM, Yasha Zislin wrote:<br>> > I have downloaded the latest suricata and compiled it the same way as I<br>> > have done before.<br>> > Everything seems to be find until i try to start it.<br>> > I get errors like these<br>> > [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc error<br>> > 3/3/2015 -- 09:33:29 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - pool<br>> > grow failed<br>> > 3/3/2015 -- 09:33:29 - <Info> - (RxPFReth219) Using PF_RING v.6.0.3,<br>> > interface eth2, cluster-id 98<br>> > 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc<br>> > error<br>> > 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - pool<br>> > grow failed<br>> > 3/3/2015 -- 09:33:30 - <Info> - (RxPFReth220) Using PF_RING v.6.0.3,<br>> > interface eth2, cluster-id 98<br>> > 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc<br>> > error<br>> > 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - pool<br>> > grow failed<br>> > 3/3/2015 -- 09:33:30 - <Info> - RunModeIdsPfringWorkers initialised<br>> > 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_THREAD_INIT(49)] -<br>> > thread "RxPFReth218" closed on initialization.<br>> > 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_INITIALIZATION(45)] -<br>> > Engine initialization failed, aborting...<br>> > <br>> > I have two interfaces with 20 threads for each. I am using latest<br>> > PF_RING (which I usually recompile as well).<br>> > <br>> > These errors seem to be PF_RING related. Any ideas?<br>> <br>> This seems to be related to the fix for issue 1318<br>> (https://redmine.openinfosecfoundation.org/issues/1318). Could you try<br>> lowering your stream.prealloc-sessions setting?<br>> <br>> -- <br>> ---------------------------------------------<br>> Victor Julien<br>> http://www.inliniac.net/<br>> PGP: http://www.inliniac.net/victorjulien.asc<br>> ---------------------------------------------<br>> <br>> _______________________________________________<br>> Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> Training now available: http://suricata-ids.org/training/<br></div> </div></body>
</html>