[Oisf-users] [8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527) <Warning> (TmThreadDrainPacketThreads) -- [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable to get all packet threads to process their packets in time

Ma Allen mazhh at outlook.com
Sun Apr 7 06:52:48 UTC 2019 

Hi everybody,

I'm writing protocol detection & parser for IMAP atop of Suricata 5.0.0-dev cloned from GitHub and encountered the problem as follows:
[8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527) <Warning> (TmThreadDrainPacketThreads) -- [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable to get all packet threads to process their packets in time

I use CentOS 7.0 VM in VMWare to run Suricata and assigned 2 processor cores + 2GB RAM to it.


While I met the problem, top command shows that the CPU usage is almost full. And I wonder that if I assigned the necessary computing resources to the VM. However, previous POP3 extension works well under the same environment.

top - 14:28:26 up  5:36,  3 users,  load average: 4.06, 1.84, 0.73
Tasks: 372 total,   2 running, 370 sleeping,   0 stopped,   0 zombie​
%Cpu(s): 99.8 us,  0.2 sy,  0.0 ni,  0.0 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st​
KiB Mem :  1868688 total,   677668 free,   445832 used,   745188 buff/cache​
KiB Swap:  2097148 total,  2097148 free,        0 used.  1247408 avail Mem​
​
   PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND​
  8778 root      20   0  792656 273396   4968 S 199.0 14.6   5:11.97 Suricata-Main​
   354 root      20   0       0      0      0 S   0.3  0.0   0:20.79 kworker/0:3​
  8786 coapk     20   0  146472   2348   1456 R   0.3  0.1   0:00.34 top​
     1 root      20   0   41344   3700   2408 S   0.0  0.2   0:02.45 systemd​
     2 root      20   0       0      0      0 S   0.0  0.0   0:00.04 kthreadd​
     3 root      20   0       0      0      0 S   0.0  0.0   0:00.26 ksoftirqd/0


The whole log is attached below:
[coapk at localhost suricata]$ sudo suricata -c ~/suricata/suricata.yaml -r ~/pcap/imap/imap_aliyun_outlook_short.pcapng -k none  --init-errors-fatal
[8778] 7/4/2019 -- 14:25:46 - (suricata.c:1085) <Notice> (LogVersion) -- This is Suricata version 5.0.0-dev (rev e710b06)​
[8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:748) <Notice> (RegisterImapParsers) -- Imap TCP protocol detection enabled.​
[8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:771) <Notice> (RegisterImapParsers) -- No imap app-layer configuration, enabling imap detection TCP detection on port 143.​
[8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:786) <Notice> (RegisterImapParsers) -- Registering Imap protocol parser.​
[8778] 7/4/2019 -- 14:25:46 - (output-json-imap.c:179) <Notice> (JsonImapLogRegister) -- Imap JSON logger registered.​
[8778] 7/4/2019 -- 14:25:47 - (output-json-imap.c:122) <Notice> (OutputImapLogInitSub) -- Imap log sub-module initialized.​
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'HTTP.UncompressedFlash' is checked but not set. Checked in 2016396 and 3 other sigs​
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.pdf.in.http' is checked but not set. Checked in 2017150 and 5 other sigs​
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.JS.Obfus.Func' is checked but not set. Checked in 2017246 and 1 other sigs​
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.http.PK' is checked but not set. Checked in 2019835 and 3 other sigs​
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.JavaArchiveOrClass' is checked but not set. Checked in 2017756 and 15 other sigs​
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.WinHttpRequest' is checked but not set. Checked in 2019822 and 1 other sigs​
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.wininet.UA' is checked but not set. Checked in 2021312 and 0 other sigs​
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.ip.request' is checked but not set. Checked in 2022050 and 1 other sigs​
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.no.exe.request' is checked but not set. Checked in 2022053 and 0 other sigs​
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.WinHttpRequest.no.exe.request' is checked but not set. Checked in 2022653 and 0 other sigs​
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.IE7.NoRef.NoCookie' is checked but not set. Checked in 2023671 and 11 other sigs​
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MCOFF' is checked but not set. Checked in 2019837 and 1 other sigs​
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'min.gethttp' is checked but not set. Checked in 2023711 and 0 other sigs​
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.armwget' is checked but not set. Checked in 2024241 and 1 other sigs​
[8778] 7/4/2019 -- 14:25:52 - (tm-threads.c:2172) <Notice> (TmThreadWaitOnThreadInit) -- all 3 packet processing threads, 4 management threads initialized, engine started.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:279) <Notice> (ImapProbingParser) -- Detected as ALPROTO_IMAP.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:179) <Notice> (ImapStateAlloc) -- Allocating imap state.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice> (ImapParseRequest) -- Parsing imap request: input=00hi CAPABILITY​
, len=17​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:584) <Notice> (ImapParseResponse) -- Parsing imap response: input=* OK AliYun IMAP Server Ready(10.182.157.147)​
* CAPABILITY IMAP4rev1 IDLE XLIST UIDPLUS ID SASL-IR AUTH=XOAUTH AUTH=EXTERNAL​
00hi OK CAPABILITY completed​
, len=157​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice> (ImapParseRequest) -- Parsing imap request: input=p6hq LOGIN "xxx at yyy.com" "zzzzzz"​
, len=40​
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:535) <Notice> (ImapParseRequest) -- imap command login request, tx_id = 0​
[8778] 7/4/2019 -- 14:25:52 - (suricata.c:2849) <Notice> (SuricataMainLoop) -- Signal Received.  Stopping engine.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:279) <Notice> (ImapProbingParser) -- Detected as ALPROTO_IMAP.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:179) <Notice> (ImapStateAlloc) -- Allocating imap state.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 0.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice> (ImapParseRequest) -- Parsing imap request: input=61xu CAPABILITY​
, len=17​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:584) <Notice> (ImapParseResponse) -- Parsing imap response: input=* OK AliYun IMAP Server Ready(10.182.157.147)​
* CAPABILITY IMAP4rev1 IDLE XLIST UIDPLUS ID SASL-IR AUTH=XOAUTH AUTH=EXTERNAL​
61xu OK CAPABILITY completed​
, len=157​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice> (ImapParseRequest) -- Parsing imap request: input=ic9a LOGIN "xxx at yyy.com" "zzzzzz"​
, len=40​
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:535) <Notice> (ImapParseRequest) -- imap command login request, tx_id = 0​
[8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527) <Warning> (TmThreadDrainPacketThreads) -- [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable to get all packet threads to process their packets in time​
​


[coapk at localhost suricata]$ suricata --build-info​
This is Suricata version 5.0.0-dev (rev e710b06)​
Features: NFQ PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA HAVE_LIBJANSSON TLS MAGIC RUST​
SIMD support: SSE_4_2 SSE_4_1 SSE_3​
Atomic intrisics: 1 2 4 8 16 byte(s)​
64-bits, Little-endian architecture​
GCC version 4.8.5 20150623 (Red Hat 4.8.5-36), C version 199901​
compiled with _FORTIFY_SOURCE=0​
L1 cache line size (CLS)=64​
thread local storage method: __thread​
compiled with LibHTP v0.5.28, linked against LibHTP v0.5.28​
​
Suricata Configuration:​
  AF_PACKET support:                       yes​
  eBPF support:                            no​
  XDP support:                             no​
  PF_RING support:                         no​
  NFQueue support:                         yes​
  NFLOG support:                           no​
  IPFW support:                            no​
  Netmap support:                          no​
  DAG enabled:                             no​
  Napatech enabled:                        no​
  WinDivert enabled:                       no​
​
  Unix socket enabled:                     yes​
  Detection enabled:                       yes​
​
  Libmagic support:                        yes​
  libnss support:                          yes​
  libnspr support:                         yes​
  libjansson support:                      yes​
  liblzma support:                         no​
  hiredis support:                         no​
  hiredis async with libevent:             no​
  Prelude support:                         no​
  PCRE jit:                                yes​
  LUA support:                             yes​
  libluajit:                               no​
  libgeoip:                                no​
  Non-bundled htp:                         no​
  Old barnyard2 support:                   no​
  Hyperscan support:                       no​
  Libnet support:                          yes​
  liblz4 support:                          no​
​
  Rust support:                            yes (default)​
  Rust strict mode:                        no​
  Rust debug mode:                         no​
  Rust compiler:                           rustc 1.32.0​
  Rust cargo:                              cargo 1.32.0​
​
  Install suricatasc:                      yes​
  Install suricata-update:                 no​
​
  Profiling enabled:                       no​
  Profiling locks enabled:                 no​
​
Development settings:​
  Coccinelle / spatch:                     no​
  Unit tests enabled:                      no​
  Debug output enabled:                    no​
  Debug validation enabled:                no​
​
Generic build parameters:​
  Installation prefix:                     /usr​
  Configuration directory:                 /etc/suricata/​
  Log directory:                           /var/log/suricata/​
​
  --prefix                                 /usr​
  --sysconfdir                             /etc​
  --localstatedir                          /var​
  --datarootdir                            /usr/share​
​
  Host:                                    x86_64-unknown-linux-gnu​
  Compiler:                                gcc (exec name) / gcc (real)​
  GCC Protect enabled:                     no​
  GCC march native enabled:                yes​
  GCC Profile enabled:                     no​
  Position Independent Executable enabled: no​
  CFLAGS                                   -g -O2 -march=native -I${srcdir}/../rust/gen/c-headers​
  PCAP_CFLAGS​
  SECCFLAGS​

Best Regards,
Allen Ma
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190407/dbeb4616/attachment-0001.html>

More information about the Oisf-users mailing list