[Oisf-devel] Mem leaks

Thu Oct 6 15:28:27 UTC 2011

Hello,

On Thu, 2011-10-06 at 10:04 -0500, Martin Holste wrote:
> With runmode=workers:
> 
> [1180] 6/10/2011 -- 10:01:38 - (runmode-pfring.c:311) <Info>
> (PfringConfLevel) -- Using 1.0 style configuration for pfring
> [1180] 6/10/2011 -- 10:01:38 - (runmode-pfring.c:497) <Info>
> (RunModeIdsPfringWorkers) -- RunModeIdsPfringSingle initialised
> [New Thread 0x7ffff303c710 (LWP 1211)]
> [1180] 6/10/2011 -- 10:01:38 - (stream-tcp.c:340) <Info>
> (StreamTcpInitConfig) -- stream "max_sessions": 262144
> [1180] 6/10/2011 -- 10:01:38 - (stream-tcp.c:352) <Info>
> (StreamTcpInitConfig) -- stream "prealloc_sessions": 32768
> [1211] 6/10/2011 -- 10:01:38 - (flow-timeout.c:528) <Error>
> (FlowForceReassemblySetup) -- [ERRCODE: SC_ERR_TM_MODULES_ERROR(135)]
> - Looks like we have failed to retrieve the slot for STREAMTCP TM
> [1180] 6/10/2011 -- 10:01:38 - (stream-tcp.c:362) <Info>
> (StreamTcpInitConfig) -- stream "memcap": 3294967295
> [1180] 6/10/2011 -- 10:01:38 - (stream-tcp.c:368) <Info>
> (StreamTcpInitConfig) -- stream "midstream" session pickups: disabled
> [1180] 6/10/2011 -- 10:01:38 - (stream-tcp.c:374) <Info>
> (StreamTcpInitConfig) -- stream "async_oneside": disabled
> [1180] 6/10/2011 -- 10:01:38 - (stream-tcp.c:391) <Info>
> (StreamTcpInitConfig) -- stream "checksum_validation": disabled
> [Thread 0x7ffff303c710 (LWP 1211) exited]
> 
> Program exited with code 01.

Can you provide me your suricata command line and your pfring section in
suricata.yaml ?

I will try to reproduce your problem here.

BR,

> 
> 
> On Thu, Oct 6, 2011 at 9:57 AM, Martin Holste <mcholste at gmail.com> wrote:
> > Fail:
> > [1174] 6/10/2011 -- 09:55:39 - (flow-timeout.c:567) <Error>
> > (FlowForceReassemblySetup) -- [ERRCODE: SC_ERR_TM_MODULES_ERROR(135)]
> > - Looks like we have failed to retrieve the slot for DECODE TM
> >
> > [615882.430464] FlowManagerThre[25159] general protection
> > ip:7fef5e231f19 sp:7fef32ffc500 error:0 in
> > libc-2.11.1.so[7fef5e1b8000+154000]
> > [674961.883749] Detect9[25393] general protection ip:7fc178164f19
> > sp:7fc15dff89d0 error:0 in libc-2.11.1.so[7fc1780eb000+154000]
> > [675399.548866] Detect1[31826] general protection ip:7f0ae5e91f19
> > sp:7f0ae0f9c9d0 error:0 in libc-2.11.1.so[7f0ae5e18000+154000]
> > [676121.801082] Detect13[31902] general protection ip:7f2b5efcbf19
> > sp:7f2b3affaa50 error:0 in libc-2.11.1.so[7f2b5ef52000+154000]
> > [682367.944179] Detect15[32018] general protection ip:7f2d8fafe8e4
> > sp:7f2d727f9910 error:0 in libc-2.11.1.so[7f2d8fa87000+154000]
> > [686004.915441] Detect14[32714] general protection ip:7f5c9cf3d8e4
> > sp:7f5c6bffc910 error:0 in libc-2.11.1.so[7f5c9cec6000+154000]
> > [691590.641728] Detect3[647] general protection ip:7fafabc3b8e4
> > sp:7faf9d54a8f0 error:0 in libc-2.11.1.so[7fafabbc4000+154000]
> > [694603.703134] Detect1[1269] general protection ip:7f2d12f39f19
> > sp:7f2d05ffc9d0 error:0 in libc-2.11.1.so[7f2d12ec0000+154000]
> > [732620.654435] FlowManagerThre[1650] general protection
> > ip:7fac0fcccf19 sp:7fabf17f9500 error:0 in
> > libc-2.11.1.so[7fac0fc53000+154000]
> > [785731.721802] Detect12[6104] general protection ip:4cb1be
> > sp:7f7d77ffec80 error:0 in suricata[400000+304000]
> > [930807.474492] Detect9[11943] general protection ip:4cb1be
> > sp:7f43397fbc80 error:0 in suricata[400000+304000]
> > [1127275.191371] suricata[4475]: segfault at 0 ip 000000000044c705 sp
> > 00007fff9fcd3250 error 4 in suricata[400000+30d000]
> > [1196275.688281] suricata[2939]: segfault at 0 ip 000000000044c705 sp
> > 00007fffd243e0e0 error 4 in suricata[400000+30d000]
> > [1203139.713559] suricata[19971]: segfault at 0 ip 000000000044c705 sp
> > 00007fff3da88cd0 error 4 in suricata[400000+30d000]
> > [1259311.992055] suricata[20819]: segfault at 60 ip 0000000000484894
> > sp 00007fffd46fd180 error 4 in suricata[400000+30d000]
> > [1274661.649791] suricata[23476]: segfault at 0 ip 000000000044c705 sp
> > 00007fff575114a0 error 4 in suricata[400000+30d000]
> > [1278440.193752] suricata[24189]: segfault at 0 ip 000000000044c705 sp
> > 00007fff12dbb140 error 4 in suricata[400000+30d000]
> >
> >
> > On Thu, Oct 6, 2011 at 9:32 AM, Victor Julien <victor at inliniac.net> wrote:
> >> On 10/06/2011 04:30 PM, Martin Holste wrote:
> >>> Yeah, maybe, but the baseline is almost double.  Do you want me to
> >>> switch back to master for awhile?
> >>
> >> If you can, please. The bigger baseline is certainly unintentional, so
> >> we'll look into that as well.
> >>
> >> Btw, I think Eric fixed the pfring shutdown thing as well in the updated
> >> master.
> >>
> >> Cheers,
> >> Victor
> >>
> >>> On Thu, Oct 6, 2011 at 9:25 AM, Victor Julien <victor at inliniac.net> wrote:
> >>>> So could it be that the master just has a higher baseline but stops
> >>>> growing at some point as well? The higher baseline might be explained by
> >>>> some AC pattern matcher updates.
> >>>>
> >>>> On 10/06/2011 02:59 AM, Martin Holste wrote:
> >>>>> bc5, still no leaks.
> >>>>>
> >>>>> On Wed, Oct 5, 2011 at 7:54 PM, Victor Julien <victor at inliniac.net> wrote:
> >>>>>> On 10/05/2011 11:41 PM, Martin Holste wrote:
> >>>>>>> Seems to be no leaks thus far after 4 hours.
> >>>>>>
> >>>>>> So what git ref is it you are running now exactly? Lost track.
> >>>>>>
> >>>>>> --
> >>>>>> ---------------------------------------------
> >>>>>> Victor Julien
> >>>>>> http://www.inliniac.net/
> >>>>>> PGP: http://www.inliniac.net/victorjulien.asc
> >>>>>> ---------------------------------------------
> >>>>>>
> >>>>>>
> >>>>>
> >>>>
> >>>>
> >>>> --
> >>>> ---------------------------------------------
> >>>> Victor Julien
> >>>> http://www.inliniac.net/
> >>>> PGP: http://www.inliniac.net/victorjulien.asc
> >>>> ---------------------------------------------
> >>>>
> >>>>
> >>>
> >>
> >>
> >> --
> >> ---------------------------------------------
> >> Victor Julien
> >> http://www.inliniac.net/
> >> PGP: http://www.inliniac.net/victorjulien.asc
> >> ---------------------------------------------
> >>
> >>
> >
> _______________________________________________
> Oisf-devel mailing list
> Oisf-devel at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel

-- 
Eric Leblond 
Blog: http://home.regit.org/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20111006/02d0c768/attachment.sig>