<p dir="ltr">I've seen illegal instruction crashes in the pcre library on some VMs.  This sounds similar to your description.</p>
<p dir="ltr">Tom</p>
<br><div class="gmail_quote"><div dir="ltr">On Fri, Apr 21, 2017, 6:01 AM Jozef Mlich <<a href="mailto:jozef.mlich@greycortex.com">jozef.mlich@greycortex.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Fri, 2017-04-21 at 16:54 +0800, <a href="mailto:tidy@holonetsecurity.com" target="_blank">tidy@holonetsecurity.com</a> wrote:<br>
<br>
Then I can suggest only running it with<br>
gdb --args suricata -c /etc/suricata.yaml --af-packet ..etc..<br>
and explore backtrace where it occurs.<br>
<br>
> Jozef,<br>
>       The Same coredump happen after changing the default config to<br>
> the suggested ones.<br>
><br>
><br>
><br>
> -Tidy<br>
><br>
> > On Apr 21, 2017, at 4:41 PM, Jozef Mlich <<a href="mailto:jozef.mlich@greycortex.co" target="_blank">jozef.mlich@greycortex.co</a><br>
> > m> wrote:<br>
> ><br>
> > On Fri, 2017-04-21 at 16:15 +0800, <a href="mailto:tidy@holonetsecurity.com" target="_blank">tidy@holonetsecurity.com</a> wrote:<br>
> ><br>
> > Hi,<br>
> ><br>
> > I have noticed illegal instruction only with some AMD and hyperscan<br>
> > enabled. You can try it with <br>
> ><br>
> > mpm-algo: ac<br>
> > spm-algo: bm <br>
> ><br>
> > in suricata.yaml, or as command line argument --set ...<br>
> ><br>
> ><br>
> > > Hi,<br>
> > >   I built Suricata using option "disable-gccmarch-native” in VM<br>
> > > host A (cpu instruction should be newer) which supporting AVX2<br>
> > > and<br>
> > > then run suricata in host B. The Suricata has crashed for for<br>
> > > illegal<br>
> > > instruction (see coredump information). <br>
> > >       Also, tried the same way in Physical host C with the newer<br>
> > > cpu<br>
> > > instruction and it can run well on Host B.<br>
> > >    <br>
> > >      So, I think the configure option “disable-gccmarch-native”<br>
> > > doesn’t work well on VM. Could some one take a look at this.<br>
> > ><br>
> > > root:1.212@work$ /usr/local/bin/suricata --build-info<br>
> > > This is Suricata version 3.2dev<br>
> > > Features: PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 AF_PACKET<br>
> > > HAVE_PACKET_FANOUT LIBCAP_NG HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT<br>
> > > HAVE_NSS HAVE_LUA TLS MAGIC <br>
> > > SIMD support: none<br>
> > > Atomic intrisics: 1 2 4 8 byte(s)<br>
> > > 64-bits, Little-endian architecture<br>
> > > GCC version 4.8.5 20150623 (Red Hat 4.8.5-11), C version 199901<br>
> > > compiled with _FORTIFY_SOURCE=0<br>
> > > L1 cache line size (CLS)=64<br>
> > > thread local storage method: __thread<br>
> > > compiled with LibHTP v0.5.23, linked against LibHTP v0.5.23<br>
> > ><br>
> > > Suricata Configuration:<br>
> > >   AF_PACKET support:                       yes<br>
> > >   PF_RING support:                         no<br>
> > >   NFQueue support:                         no<br>
> > >   NFLOG support:                           no<br>
> > >   IPFW support:                            no<br>
> > >   Netmap support:                          no<br>
> > >   DAG enabled:                             no<br>
> > >   Napatech enabled:                        no<br>
> > ><br>
> > >   Unix socket enabled:                     no<br>
> > >   Detection enabled:                       yes<br>
> > ><br>
> > >   Libmagic support:                        yes<br>
> > >   libnss support:                          yes<br>
> > >   libnspr support:                         yes<br>
> > >   libjansson support:                      no<br>
> > >   hiredis support:                         yes<br>
> > >   Prelude support:                         no<br>
> > >   PCRE jit:                                yes<br>
> > >   LUA support:                             yes<br>
> > >   libluajit:                               no<br>
> > >   libgeoip:                                no<br>
> > >   Non-bundled htp:                         yes<br>
> > >   Old barnyard2 support:                   no<br>
> > >   CUDA enabled:                            no<br>
> > >   Hyperscan support:                       yes<br>
> > >   Libnet support:                          no<br>
> > ><br>
> > >   Suricatasc install:                      yes<br>
> > ><br>
> > >   Profiling enabled:                       no<br>
> > >   Profiling locks enabled:                 no<br>
> > ><br>
> > > Development settings:<br>
> > >   Coccinelle / spatch:                     no<br>
> > >   Unit tests enabled:                      no<br>
> > >   Debug output enabled:                    no<br>
> > >   Debug validation enabled:                no<br>
> > ><br>
> > > Generic build parameters:<br>
> > >   Installation prefix:                     /usr/local/<br>
> > >   Configuration directory:                <br>
> > > /usr/local/etc/suricata/<br>
> > >   Log directory:                          <br>
> > > /usr/local/var/log/suricata/<br>
> > ><br>
> > >   --prefix                                 /usr/local/<br>
> > >   --sysconfdir                             /usr/local/etc<br>
> > >   --localstatedir                          /usr/local/var<br>
> > ><br>
> > >   Host:                                    x86_64-unknown-linux-<br>
> > > gnu<br>
> > >   Compiler:                                gcc (exec name) / gcc<br>
> > > (real)<br>
> > >   GCC Protect enabled:                     no<br>
> > >   GCC march native enabled:                no<br>
> > >   GCC Profile enabled:                     no<br>
> > >   Position Independent Executable enabled: no<br>
> > >   CFLAGS                                   -g -O2<br>
> > >   PCAP_CFLAGS                              <br>
> > > -I/usr/local/deps/include<br>
> > >   SECCFLAGS                                <br>
> > ><br>
> > > Here is the coredump information, its cored at strtod<br>
> > ><br>
> > ><br>
> > > _______________________________________________<br>
> > > Suricata IDS Users mailing list: oisf-users@openinfosecfoundation<br>
> > > .org<br>
> > > Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-" rel="noreferrer" target="_blank">http://suricata-</a><br>
> > > <a href="http://ids.org/support/" rel="noreferrer" target="_blank">ids.org/support/</a><br>
> > > List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oi" rel="noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oi</a><br>
> > > sf-u<br>
> > > sers<br>
> > -- <br>
> > Jozef Mlich <<a href="mailto:jozef.mlich@greycortex.com" target="_blank">jozef.mlich@greycortex.com</a>><br>
><br>
><br>
--<br>
Jozef Mlich <<a href="mailto:jozef.mlich@greycortex.com" target="_blank">jozef.mlich@greycortex.com</a>><br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
</blockquote></div>