<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span>Hi everybody,</span></span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span><br>
</span></span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span>I'm writing protocol detection & parser for <span style="display: inline !important; font-family: Calibri,Helvetica,sans-serif; font-size-adjust: none; font-stretch: 100%">IMAP atop of Suricata 5.0.0-dev cloned from GitHub and encountered the problem
as follows:</span></span></span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span><span style="display: inline !important; font-family: Calibri,Helvetica,sans-serif; font-size-adjust: none; font-stretch: 100%">[8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527) <Warning> (TmThreadDrainPacketThreads) -- [ERRCODE: SC_ERR_SHUTDOWN(188)]
- unable to get all packet threads to process their packets in time</span></span></span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span><span style="display: inline !important; font-family: Calibri,Helvetica,sans-serif; font-size-adjust: none; font-stretch: 100%"><br>
</span></span></span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
I use CentOS 7.0 VM in<span><span><span style="display: inline !important; font-family: Calibri,Helvetica,sans-serif; font-size-adjust: none; font-stretch: 100%"> VMWare to run Suricata and assigned 2 processor cores + 2GB RAM to it.</span></span></span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span><span style="display: inline !important; font-family: Calibri,Helvetica,sans-serif; font-size-adjust: none; font-stretch: 100%"><br>
</span></span></span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span><span style="display: inline !important; font-family: Calibri,Helvetica,sans-serif; font-size-adjust: none; font-stretch: 100%">
<div style="font-family: Calibri,Helvetica,sans-serif; font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
<span style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px"><span style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px"><span style="display: inline; font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
<br>
</div>
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
While I met the problem, top command shows that the CPU usage is almost full. And I wonder that if I assigned the necessary computing resources to the VM. However, previous POP3 extension works well under the same environment. </div>
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
<br>
</div>
</span></span></span></div>
<div style="font-family: Calibri,Helvetica,sans-serif; font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
<span style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px"><span style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px"><span style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">top
- 14:28:26 up 5:36, 3 users, load average: 4.06, 1.84, 0.73<br>
</span>
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
Tasks: 372 total, 2 running, 370 sleeping, 0 stopped, 0 zombie</div>
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
%Cpu(s): 99.8 us, 0.2 sy, 0.0 ni, 0.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st</div>
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
KiB Mem : 1868688 total, 677668 free, 445832 used, 745188 buff/cache</div>
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
KiB Swap: 2097148 total, 2097148 free, 0 used. 1247408 avail Mem</div>
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
</div>
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND</div>
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
8778 root 20 0 792656 273396 4968 S 199.0 14.6 5:11.97 Suricata-Main</div>
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
354 root 20 0 0 0 0 S 0.3 0.0 0:20.79 kworker/0:3</div>
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
8786 coapk 20 0 146472 2348 1456 R 0.3 0.1 0:00.34 top</div>
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
1 root 20 0 41344 3700 2408 S 0.0 0.2 0:02.45 systemd</div>
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
2 root 20 0 0 0 0 S 0.0 0.0 0:00.04 kthreadd</div>
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
<span style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px"> 3 root 20 0 0 0 0 S 0.0 0.0 0:00.26 ksoftirqd/0</span></div>
<div style="font-size-adjust: none; font-stretch: 100%; margin-bottom: 0px; margin-top: 0px">
</div>
</span></span></div>
<div><br>
</div>
<div><br>
</div>
</span></span></span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span><span style="display: inline !important; font-family: Calibri,Helvetica,sans-serif; font-size-adjust: none; font-stretch: 100%">The whole log is attached below:</span></span></span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span><span style="display: inline !important; font-family: Calibri,Helvetica,sans-serif; font-size-adjust: none; font-stretch: 100%"><span>[coapk@localhost suricata]$ sudo suricata -c ~/suricata/suricata.yaml -r ~/pcap/imap/imap_aliyun_outlook_short.pcapng
-k none --init-errors-fatal<br>
</span>
<div>[8778] 7/4/2019 -- 14:25:46 - (suricata.c:1085) <Notice> (LogVersion) -- This is Suricata version 5.0.0-dev (rev e710b06)</div>
<div>[8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:748) <Notice> (RegisterImapParsers) -- Imap TCP protocol detection enabled.</div>
<div>[8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:771) <Notice> (RegisterImapParsers) -- No imap app-layer configuration, enabling imap detection TCP detection on port 143.</div>
<div>[8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:786) <Notice> (RegisterImapParsers) -- Registering Imap protocol parser.</div>
<div>[8778] 7/4/2019 -- 14:25:46 - (output-json-imap.c:179) <Notice> (JsonImapLogRegister) -- Imap JSON logger registered.</div>
<div>[8778] 7/4/2019 -- 14:25:47 - (output-json-imap.c:122) <Notice> (OutputImapLogInitSub) -- Imap log sub-module initialized.</div>
<div>[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'HTTP.UncompressedFlash' is checked but not set. Checked in 2016396 and 3 other sigs</div>
<div>[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.pdf.in.http' is checked but not set. Checked in 2017150 and 5 other sigs</div>
<div>[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.JS.Obfus.Func' is checked but not set. Checked in 2017246 and 1 other sigs</div>
<div>[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.http.PK' is checked but not set. Checked in 2019835 and 3 other sigs</div>
<div>[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.JavaArchiveOrClass' is checked but not set. Checked in 2017756 and 15 other sigs</div>
<div>[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.WinHttpRequest' is checked but not set. Checked in 2019822 and 1 other sigs</div>
<div>[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.wininet.UA' is checked but not set. Checked in 2021312 and 0 other sigs</div>
<div>[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.ip.request' is checked but not set. Checked in 2022050 and 1 other sigs</div>
<div>[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.no.exe.request' is checked but not set. Checked in 2022053 and 0 other sigs</div>
<div>[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.WinHttpRequest.no.exe.request' is checked but not set. Checked in 2022653 and 0 other sigs</div>
<div>[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.IE7.NoRef.NoCookie' is checked but not set. Checked in 2023671 and 11 other sigs</div>
<div>[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MCOFF' is checked but not set. Checked in 2019837 and 1 other sigs</div>
<div>[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'min.gethttp' is checked but not set. Checked in 2023711 and 0 other sigs</div>
<div>[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.armwget' is checked but not set. Checked in 2024241 and 1 other sigs</div>
<div>[8778] 7/4/2019 -- 14:25:52 - (tm-threads.c:2172) <Notice> (TmThreadWaitOnThreadInit) -- all 3 packet processing threads, 4 management threads initialized, engine started.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:279) <Notice> (ImapProbingParser) -- Detected as ALPROTO_IMAP.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:179) <Notice> (ImapStateAlloc) -- Allocating imap state.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice> (ImapParseRequest) -- Parsing imap request: input=00hi CAPABILITY</div>
<div>, len=17</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:584) <Notice> (ImapParseResponse) -- Parsing imap response: input=* OK AliYun IMAP Server Ready(10.182.157.147)</div>
<div>* CAPABILITY IMAP4rev1 IDLE XLIST UIDPLUS ID SASL-IR AUTH=XOAUTH AUTH=EXTERNAL</div>
<div>00hi OK CAPABILITY completed</div>
<div>, len=157</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice> (ImapParseRequest) -- Parsing imap request: input=p6hq LOGIN "xxx@yyy.com" "zzzzzz"</div>
<div>, len=40</div>
<div>[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:535) <Notice> (ImapParseRequest) -- imap command login request, tx_id = 0</div>
<div>[8778] 7/4/2019 -- 14:25:52 - (suricata.c:2849) <Notice> (SuricataMainLoop) -- Signal Received. Stopping engine.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:279) <Notice> (ImapProbingParser) -- Detected as ALPROTO_IMAP.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:179) <Notice> (ImapStateAlloc) -- Allocating imap state.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 0.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice> (ImapParseRequest) -- Parsing imap request: input=61xu CAPABILITY</div>
<div>, len=17</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:584) <Notice> (ImapParseResponse) -- Parsing imap response: input=* OK AliYun IMAP Server Ready(10.182.157.147)</div>
<div>* CAPABILITY IMAP4rev1 IDLE XLIST UIDPLUS ID SASL-IR AUTH=XOAUTH AUTH=EXTERNAL</div>
<div>61xu OK CAPABILITY completed</div>
<div>, len=157</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice> (ImapParseRequest) -- Parsing imap request: input=ic9a LOGIN "xxx@yyy.com" "zzzzzz"</div>
<div>, len=40</div>
<div>[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:535) <Notice> (ImapParseRequest) -- imap command login request, tx_id = 0</div>
<div>[8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527) <Warning> (TmThreadDrainPacketThreads) -- [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable to get all packet threads to process their packets in time</div>
<div><br>
</div>
</span></span></span>
<div><span><span><br>
</span></span></div>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span><br>
</span>
<div>[coapk@localhost suricata]$ suricata --build-info</div>
<div>This is Suricata version 5.0.0-dev (rev e710b06)</div>
<div>Features: NFQ PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA HAVE_LIBJANSSON TLS MAGIC RUST</div>
<div>SIMD support: SSE_4_2 SSE_4_1 SSE_3</div>
<div>Atomic intrisics: 1 2 4 8 16 byte(s)</div>
<div>64-bits, Little-endian architecture</div>
<div>GCC version 4.8.5 20150623 (Red Hat 4.8.5-36), C version 199901</div>
<div>compiled with _FORTIFY_SOURCE=0</div>
<div>L1 cache line size (CLS)=64</div>
<div>thread local storage method: __thread</div>
<div>compiled with LibHTP v0.5.28, linked against LibHTP v0.5.28</div>
<div></div>
<div>Suricata Configuration:</div>
<div> AF_PACKET support: yes</div>
<div> eBPF support: no</div>
<div> XDP support: no</div>
<div> PF_RING support: no</div>
<div> NFQueue support: yes</div>
<div> NFLOG support: no</div>
<div> IPFW support: no</div>
<div> Netmap support: no</div>
<div> DAG enabled: no</div>
<div> Napatech enabled: no</div>
<div> WinDivert enabled: no</div>
<div></div>
<div> Unix socket enabled: yes</div>
<div> Detection enabled: yes</div>
<div></div>
<div> Libmagic support: yes</div>
<div> libnss support: yes</div>
<div> libnspr support: yes</div>
<div> libjansson support: yes</div>
<div> liblzma support: no</div>
<div> hiredis support: no</div>
<div> hiredis async with libevent: no</div>
<div> Prelude support: no</div>
<div> PCRE jit: yes</div>
<div> LUA support: yes</div>
<div> libluajit: no</div>
<div> libgeoip: no</div>
<div> Non-bundled htp: no</div>
<div> Old barnyard2 support: no</div>
<div> Hyperscan support: no</div>
<div> Libnet support: yes</div>
<div> liblz4 support: no</div>
<div></div>
<div> Rust support: yes (default)</div>
<div> Rust strict mode: no</div>
<div> Rust debug mode: no</div>
<div> Rust compiler: rustc 1.32.0</div>
<div> Rust cargo: cargo 1.32.0</div>
<div></div>
<div> Install suricatasc: yes</div>
<div> Install suricata-update: no</div>
<div></div>
<div> Profiling enabled: no</div>
<div> Profiling locks enabled: no</div>
<div></div>
<div>Development settings:</div>
<div> Coccinelle / spatch: no</div>
<div> Unit tests enabled: no</div>
<div> Debug output enabled: no</div>
<div> Debug validation enabled: no</div>
<div></div>
<div>Generic build parameters:</div>
<div> Installation prefix: /usr</div>
<div> Configuration directory: /etc/suricata/</div>
<div> Log directory: /var/log/suricata/</div>
<div></div>
<div> --prefix /usr</div>
<div> --sysconfdir /etc</div>
<div> --localstatedir /var</div>
<div> --datarootdir /usr/share</div>
<div></div>
<div> Host: x86_64-unknown-linux-gnu</div>
<div> Compiler: gcc (exec name) / gcc (real)</div>
<div> GCC Protect enabled: no</div>
<div> GCC march native enabled: yes</div>
<div> GCC Profile enabled: no</div>
<div> Position Independent Executable enabled: no</div>
<div> CFLAGS -g -O2 -march=native -I${srcdir}/../rust/gen/c-headers</div>
<div> PCAP_CFLAGS</div>
<div> SECCFLAGS</div>
<div><span></span><br>
</div>
<div>Best Regards,</div>
<div>Allen Ma</div>
</span></div>
</body>
</html>