[Oisf-users] suricata VMware to ESX migration, now segfaulting

[Victor Julien]

On 12/19/2014 10:27 PM, Jay M. wrote:
> I created a OVF of my original fully working setup (running in VMware
> 10), and transferred to an esx host. OS runs great and I had no issues
> reconfiguring the NICs. I'm now using erspan to a virtual e1000 nic
> (using kernel drivers for this, currently ArchLinux 3.17.6., may try
> latest from Intel next) instead of the USB3 dongle I was using in
> VMware.
> 
> Anyway, suricata 2.1beta2 is now segfaulting nearly immediately on start:
> Suricata-Main[337] trap invalid opcode ip:5409ab sp:7fff08a03b78
> error: 0 in suricata[400000+205000[
> 
> I'm thinking this is the nic "hardware", as not much else has changed.
> 
> I will run a better trace, but thought I'd see if others are running a
> similar setup and had any advice? I'm running esx5.5 currently.

By default suri is compiled with gcc's march=native, which means it
optimizes for the host it compiles on. This makes the binary
non-portable to other hw. So I would suggest either compiling it on the
VM, or passing --disable-gccmarch-native to ./configure.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------