[Oisf-devel] Mem leaks

Thu Oct 6 15:31:14 UTC 2011

pfring:
  threads: 8 #1
 interface: eth4
  cluster-id: 99
  cluster-type: cluster_flow

suricata -c suricata.yaml --pfring

PF_RING 4.7.4

On Thu, Oct 6, 2011 at 10:28 AM, Eric Leblond <eric at regit.org> wrote:
> Hello,
>
> On Thu, 2011-10-06 at 10:04 -0500, Martin Holste wrote:
>> With runmode=workers:
>>
>> [1180] 6/10/2011 -- 10:01:38 - (runmode-pfring.c:311) <Info>
>> (PfringConfLevel) -- Using 1.0 style configuration for pfring
>> [1180] 6/10/2011 -- 10:01:38 - (runmode-pfring.c:497) <Info>
>> (RunModeIdsPfringWorkers) -- RunModeIdsPfringSingle initialised
>> [New Thread 0x7ffff303c710 (LWP 1211)]
>> [1180] 6/10/2011 -- 10:01:38 - (stream-tcp.c:340) <Info>
>> (StreamTcpInitConfig) -- stream "max_sessions": 262144
>> [1180] 6/10/2011 -- 10:01:38 - (stream-tcp.c:352) <Info>
>> (StreamTcpInitConfig) -- stream "prealloc_sessions": 32768
>> [1211] 6/10/2011 -- 10:01:38 - (flow-timeout.c:528) <Error>
>> (FlowForceReassemblySetup) -- [ERRCODE: SC_ERR_TM_MODULES_ERROR(135)]
>> - Looks like we have failed to retrieve the slot for STREAMTCP TM
>> [1180] 6/10/2011 -- 10:01:38 - (stream-tcp.c:362) <Info>
>> (StreamTcpInitConfig) -- stream "memcap": 3294967295
>> [1180] 6/10/2011 -- 10:01:38 - (stream-tcp.c:368) <Info>
>> (StreamTcpInitConfig) -- stream "midstream" session pickups: disabled
>> [1180] 6/10/2011 -- 10:01:38 - (stream-tcp.c:374) <Info>
>> (StreamTcpInitConfig) -- stream "async_oneside": disabled
>> [1180] 6/10/2011 -- 10:01:38 - (stream-tcp.c:391) <Info>
>> (StreamTcpInitConfig) -- stream "checksum_validation": disabled
>> [Thread 0x7ffff303c710 (LWP 1211) exited]
>>
>> Program exited with code 01.
>
> Can you provide me your suricata command line and your pfring section in
> suricata.yaml ?
>
> I will try to reproduce your problem here.
>
> BR,
>
>>
>>
>> On Thu, Oct 6, 2011 at 9:57 AM, Martin Holste <mcholste at gmail.com> wrote:
>> > Fail:
>> > [1174] 6/10/2011 -- 09:55:39 - (flow-timeout.c:567) <Error>
>> > (FlowForceReassemblySetup) -- [ERRCODE: SC_ERR_TM_MODULES_ERROR(135)]
>> > - Looks like we have failed to retrieve the slot for DECODE TM
>> >
>> > [615882.430464] FlowManagerThre[25159] general protection
>> > ip:7fef5e231f19 sp:7fef32ffc500 error:0 in
>> > libc-2.11.1.so[7fef5e1b8000+154000]
>> > [674961.883749] Detect9[25393] general protection ip:7fc178164f19
>> > sp:7fc15dff89d0 error:0 in libc-2.11.1.so[7fc1780eb000+154000]
>> > [675399.548866] Detect1[31826] general protection ip:7f0ae5e91f19
>> > sp:7f0ae0f9c9d0 error:0 in libc-2.11.1.so[7f0ae5e18000+154000]
>> > [676121.801082] Detect13[31902] general protection ip:7f2b5efcbf19
>> > sp:7f2b3affaa50 error:0 in libc-2.11.1.so[7f2b5ef52000+154000]
>> > [682367.944179] Detect15[32018] general protection ip:7f2d8fafe8e4
>> > sp:7f2d727f9910 error:0 in libc-2.11.1.so[7f2d8fa87000+154000]
>> > [686004.915441] Detect14[32714] general protection ip:7f5c9cf3d8e4
>> > sp:7f5c6bffc910 error:0 in libc-2.11.1.so[7f5c9cec6000+154000]
>> > [691590.641728] Detect3[647] general protection ip:7fafabc3b8e4
>> > sp:7faf9d54a8f0 error:0 in libc-2.11.1.so[7fafabbc4000+154000]
>> > [694603.703134] Detect1[1269] general protection ip:7f2d12f39f19
>> > sp:7f2d05ffc9d0 error:0 in libc-2.11.1.so[7f2d12ec0000+154000]
>> > [732620.654435] FlowManagerThre[1650] general protection
>> > ip:7fac0fcccf19 sp:7fabf17f9500 error:0 in
>> > libc-2.11.1.so[7fac0fc53000+154000]
>> > [785731.721802] Detect12[6104] general protection ip:4cb1be
>> > sp:7f7d77ffec80 error:0 in suricata[400000+304000]
>> > [930807.474492] Detect9[11943] general protection ip:4cb1be
>> > sp:7f43397fbc80 error:0 in suricata[400000+304000]
>> > [1127275.191371] suricata[4475]: segfault at 0 ip 000000000044c705 sp
>> > 00007fff9fcd3250 error 4 in suricata[400000+30d000]
>> > [1196275.688281] suricata[2939]: segfault at 0 ip 000000000044c705 sp
>> > 00007fffd243e0e0 error 4 in suricata[400000+30d000]
>> > [1203139.713559] suricata[19971]: segfault at 0 ip 000000000044c705 sp
>> > 00007fff3da88cd0 error 4 in suricata[400000+30d000]
>> > [1259311.992055] suricata[20819]: segfault at 60 ip 0000000000484894
>> > sp 00007fffd46fd180 error 4 in suricata[400000+30d000]
>> > [1274661.649791] suricata[23476]: segfault at 0 ip 000000000044c705 sp
>> > 00007fff575114a0 error 4 in suricata[400000+30d000]
>> > [1278440.193752] suricata[24189]: segfault at 0 ip 000000000044c705 sp
>> > 00007fff12dbb140 error 4 in suricata[400000+30d000]
>> >
>> >
>> > On Thu, Oct 6, 2011 at 9:32 AM, Victor Julien <victor at inliniac.net> wrote:
>> >> On 10/06/2011 04:30 PM, Martin Holste wrote:
>> >>> Yeah, maybe, but the baseline is almost double.  Do you want me to
>> >>> switch back to master for awhile?
>> >>
>> >> If you can, please. The bigger baseline is certainly unintentional, so
>> >> we'll look into that as well.
>> >>
>> >> Btw, I think Eric fixed the pfring shutdown thing as well in the updated
>> >> master.
>> >>
>> >> Cheers,
>> >> Victor
>> >>
>> >>> On Thu, Oct 6, 2011 at 9:25 AM, Victor Julien <victor at inliniac.net> wrote:
>> >>>> So could it be that the master just has a higher baseline but stops
>> >>>> growing at some point as well? The higher baseline might be explained by
>> >>>> some AC pattern matcher updates.
>> >>>>
>> >>>> On 10/06/2011 02:59 AM, Martin Holste wrote:
>> >>>>> bc5, still no leaks.
>> >>>>>
>> >>>>> On Wed, Oct 5, 2011 at 7:54 PM, Victor Julien <victor at inliniac.net> wrote:
>> >>>>>> On 10/05/2011 11:41 PM, Martin Holste wrote:
>> >>>>>>> Seems to be no leaks thus far after 4 hours.
>> >>>>>>
>> >>>>>> So what git ref is it you are running now exactly? Lost track.
>> >>>>>>
>> >>>>>> --
>> >>>>>> ---------------------------------------------
>> >>>>>> Victor Julien
>> >>>>>> http://www.inliniac.net/
>> >>>>>> PGP: http://www.inliniac.net/victorjulien.asc
>> >>>>>> ---------------------------------------------
>> >>>>>>
>> >>>>>>
>> >>>>>
>> >>>>
>> >>>>
>> >>>> --
>> >>>> ---------------------------------------------
>> >>>> Victor Julien
>> >>>> http://www.inliniac.net/
>> >>>> PGP: http://www.inliniac.net/victorjulien.asc
>> >>>> ---------------------------------------------
>> >>>>
>> >>>>
>> >>>
>> >>
>> >>
>> >> --
>> >> ---------------------------------------------
>> >> Victor Julien
>> >> http://www.inliniac.net/
>> >> PGP: http://www.inliniac.net/victorjulien.asc
>> >> ---------------------------------------------
>> >>
>> >>
>> >
>> _______________________________________________
>> Oisf-devel mailing list
>> Oisf-devel at openinfosecfoundation.org
>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
>
> --
> Eric Leblond
> Blog: http://home.regit.org/
>