[Oisf-devel] [8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527) <Warning> (TmThreadDrainPacketThreads) -- [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable to get all packet threads to process their packets in time

Mon Apr 8 11:36:26 UTC 2019

Hi,

On 07-04-19 08:52, Ma Allen wrote:
> I'm writing protocol detection & parser for IMAP atop of Suricata
> 5.0.0-dev cloned from GitHub and encountered the problem as follows:
> [8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527) <Warning>
> (TmThreadDrainPacketThreads) -- [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable
> to get all packet threads to process their packets in time
> 
> I use CentOS 7.0 VM inVMWare to run Suricata and assigned 2 processor
> cores + 2GB RAM to it.
> 
> 
> While I met the problem, top command shows that the CPU usage is almost
> full. And I wonder that if I assigned the necessary computing resources
> to the VM. However, previous POP3 extension works well under the same
> environment. 

I think the most likely condition for this would be that some code in
your parser enters an endless loop. I would suggest inspecting the
program with gdb when its running to make sure its not stuck somewhere.

Regards,
Victor

> top - 14:28:26 up  5:36,  3 users,  load average: 4.06, 1.84, 0.73
> Tasks: 372 total,   2 running, 370 sleeping,   0 stopped,   0 zombie
> %Cpu(s): 99.8 us,  0.2 sy,  0.0 ni,  0.0 id,  0.0 wa,  0.0 hi,  0.0 si,
>  0.0 st
> KiB Mem :  1868688 total,   677668 free,   445832 used,   745188 buff/cache
> KiB Swap:  2097148 total,  2097148 free,        0 used.  1247408 avail Mem
> 
>    PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+
> COMMAND
>   8778 root      20   0  792656 273396   4968 S 199.0 14.6   5:11.97
> Suricata-Main
>    354 root      20   0       0      0      0 S   0.3  0.0   0:20.79
> kworker/0:3
>   8786 coapk     20   0  146472   2348   1456 R   0.3  0.1   0:00.34 top
>      1 root      20   0   41344   3700   2408 S   0.0  0.2   0:02.45
> systemd
>      2 root      20   0       0      0      0 S   0.0  0.0   0:00.04
> kthreadd
>      3 root      20   0       0      0      0 S   0.0  0.0   0:00.26
> ksoftirqd/0
> 
> 
> The whole log is attached below:
> [coapk at localhost suricata]$ sudo suricata -c ~/suricata/suricata.yaml -r
> ~/pcap/imap/imap_aliyun_outlook_short.pcapng -k none  --init-errors-fatal
> [8778] 7/4/2019 -- 14:25:46 - (suricata.c:1085) <Notice> (LogVersion) --
> This is Suricata version 5.0.0-dev (rev e710b06)
> [8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:748) <Notice>
> (RegisterImapParsers) -- Imap TCP protocol detection enabled.
> [8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:771) <Notice>
> (RegisterImapParsers) -- No imap app-layer configuration, enabling imap
> detection TCP detection on port 143.
> [8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:786) <Notice>
> (RegisterImapParsers) -- Registering Imap protocol parser.
> [8778] 7/4/2019 -- 14:25:46 - (output-json-imap.c:179) <Notice>
> (JsonImapLogRegister) -- Imap JSON logger registered.
> [8778] 7/4/2019 -- 14:25:47 - (output-json-imap.c:122) <Notice>
> (OutputImapLogInitSub) -- Imap log sub-module initialized.
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'HTTP.UncompressedFlash' is checked but not set. Checked in 2016396 and
> 3 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'ET.pdf.in.http' is checked but not set. Checked in 2017150 and 5 other
> sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'ET.JS.Obfus.Func' is checked but not set. Checked in 2017246 and 1
> other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.http.PK' is checked but not set. Checked in 2019835 and 3 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.JavaArchiveOrClass' is checked but not set. Checked in 2017756 and
> 15 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.WinHttpRequest' is checked but not set. Checked in 2019822 and 1
> other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'ET.wininet.UA' is checked but not set. Checked in 2021312 and 0 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.MS.XMLHTTP.ip.request' is checked but not set. Checked in 2022050
> and 1 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.MS.XMLHTTP.no.exe.request' is checked but not set. Checked in
> 2022053 and 0 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.MS.WinHttpRequest.no.exe.request' is checked but not set. Checked in
> 2022653 and 0 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.IE7.NoRef.NoCookie' is checked but not set. Checked in 2023671 and
> 11 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.MCOFF' is checked but not set. Checked in 2019837 and 1 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'min.gethttp' is checked but not set. Checked in 2023711 and 0 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'ET.armwget' is checked but not set. Checked in 2024241 and 1 other sigs
> [8778] 7/4/2019 -- 14:25:52 - (tm-threads.c:2172) <Notice>
> (TmThreadWaitOnThreadInit) -- all 3 packet processing threads, 4
> management threads initialized, engine started.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:279) <Notice>
> (ImapProbingParser) -- Detected as ALPROTO_IMAP.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:179) <Notice>
> (ImapStateAlloc) -- Allocating imap state.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice>
> (ImapParseRequest) -- Parsing imap request: input=00hi CAPABILITY
> , len=17
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:584) <Notice>
> (ImapParseResponse) -- Parsing imap response: input=* OK AliYun IMAP
> Server Ready(10.182.157.147)
> * CAPABILITY IMAP4rev1 IDLE XLIST UIDPLUS ID SASL-IR AUTH=XOAUTH
> AUTH=EXTERNAL
> 00hi OK CAPABILITY completed
> , len=157
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice>
> (ImapParseRequest) -- Parsing imap request: input=p6hq LOGIN
> "xxx at yyy.com" "zzzzzz"
> , len=40
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:535) <Notice>
> (ImapParseRequest) -- imap command login request, tx_id = 0
> [8778] 7/4/2019 -- 14:25:52 - (suricata.c:2849) <Notice>
> (SuricataMainLoop) -- Signal Received.  Stopping engine.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:279) <Notice>
> (ImapProbingParser) -- Detected as ALPROTO_IMAP.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:179) <Notice>
> (ImapStateAlloc) -- Allocating imap state.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice>
> (ImapParseRequest) -- Parsing imap request: input=61xu CAPABILITY
> , len=17
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:584) <Notice>
> (ImapParseResponse) -- Parsing imap response: input=* OK AliYun IMAP
> Server Ready(10.182.157.147)
> * CAPABILITY IMAP4rev1 IDLE XLIST UIDPLUS ID SASL-IR AUTH=XOAUTH
> AUTH=EXTERNAL
> 61xu OK CAPABILITY completed
> , len=157
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice>
> (ImapParseRequest) -- Parsing imap request: input=ic9a LOGIN
> "xxx at yyy.com" "zzzzzz"
> , len=40
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:535) <Notice>
> (ImapParseRequest) -- imap command login request, tx_id = 0
> [8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527) <Warning>
> (TmThreadDrainPacketThreads) -- [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable
> to get all packet threads to process their packets in time
> 
> 
> 
> [coapk at localhost suricata]$ suricata --build-info
> This is Suricata version 5.0.0-dev (rev e710b06)
> Features: NFQ PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG
> LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA
> HAVE_LIBJANSSON TLS MAGIC RUST
> SIMD support: SSE_4_2 SSE_4_1 SSE_3
> Atomic intrisics: 1 2 4 8 16 byte(s)
> 64-bits, Little-endian architecture
> GCC version 4.8.5 20150623 (Red Hat 4.8.5-36), C version 199901
> compiled with _FORTIFY_SOURCE=0
> L1 cache line size (CLS)=64
> thread local storage method: __thread
> compiled with LibHTP v0.5.28, linked against LibHTP v0.5.28
> 
> Suricata Configuration:
>   AF_PACKET support:                       yes
>   eBPF support:                            no
>   XDP support:                             no
>   PF_RING support:                         no
>   NFQueue support:                         yes
>   NFLOG support:                           no
>   IPFW support:                            no
>   Netmap support:                          no
>   DAG enabled:                             no
>   Napatech enabled:                        no
>   WinDivert enabled:                       no
> 
>   Unix socket enabled:                     yes
>   Detection enabled:                       yes
> 
>   Libmagic support:                        yes
>   libnss support:                          yes
>   libnspr support:                         yes
>   libjansson support:                      yes
>   liblzma support:                         no
>   hiredis support:                         no
>   hiredis async with libevent:             no
>   Prelude support:                         no
>   PCRE jit:                                yes
>   LUA support:                             yes
>   libluajit:                               no
>   libgeoip:                                no
>   Non-bundled htp:                         no
>   Old barnyard2 support:                   no
>   Hyperscan support:                       no
>   Libnet support:                          yes
>   liblz4 support:                          no
> 
>   Rust support:                            yes (default)
>   Rust strict mode:                        no
>   Rust debug mode:                         no
>   Rust compiler:                           rustc 1.32.0
>   Rust cargo:                              cargo 1.32.0
> 
>   Install suricatasc:                      yes
>   Install suricata-update:                 no
> 
>   Profiling enabled:                       no
>   Profiling locks enabled:                 no
> 
> Development settings:
>   Coccinelle / spatch:                     no
>   Unit tests enabled:                      no
>   Debug output enabled:                    no
>   Debug validation enabled:                no
> 
> Generic build parameters:
>   Installation prefix:                     /usr
>   Configuration directory:                 /etc/suricata/
>   Log directory:                           /var/log/suricata/
> 
>   --prefix                                 /usr
>   --sysconfdir                             /etc
>   --localstatedir                          /var
>   --datarootdir                            /usr/share
> 
>   Host:                                    x86_64-unknown-linux-gnu
>   Compiler:                                gcc (exec name) / gcc (real)
>   GCC Protect enabled:                     no
>   GCC march native enabled:                yes
>   GCC Profile enabled:                     no
>   Position Independent Executable enabled: no
>   CFLAGS                                   -g -O2 -march=native
> -I${srcdir}/../rust/gen/c-headers
>   PCAP_CFLAGS
>   SECCFLAGS
> 
> Best Regards,
> Allen Ma
> 
> _______________________________________________
> Suricata IDS Devel mailing list: oisf-devel at openinfosecfoundation.org
> Site: http://suricata-ids.org | Participate: http://suricata-ids.org/participate/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
> Redmine: https://redmine.openinfosecfoundation.org/
> 

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------